The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.
References
Link | Resource |
---|---|
https://access.redhat.com/security/cve/cve-2010-3299 | Broken Link |
https://seclists.org/oss-sec/2010/q3/357 | Mailing List Third Party Advisory |
https://security-tracker.debian.org/tracker/CVE-2010-3299 | Third Party Advisory |
https://www.usenix.org/legacy/events/woot10/tech/full_papers/Rizzo.pdf | Exploit Third Party Advisory |
Configurations
History
No history.
Information
Published : 2019-11-12 21:15
Updated : 2024-02-28 17:28
NVD link : CVE-2010-3299
Mitre link : CVE-2010-3299
CVE.ORG link : CVE-2010-3299
JSON object : View
Products Affected
debian
- debian_linux
rubyonrails
- rails
CWE
CWE-311
Missing Encryption of Sensitive Data