The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.
References
Link | Resource |
---|---|
https://access.redhat.com/security/cve/cve-2010-3299 | Broken Link |
https://seclists.org/oss-sec/2010/q3/357 | Mailing List Third Party Advisory |
https://security-tracker.debian.org/tracker/CVE-2010-3299 | Third Party Advisory |
https://www.usenix.org/legacy/events/woot10/tech/full_papers/Rizzo.pdf | Exploit Third Party Advisory |
https://access.redhat.com/security/cve/cve-2010-3299 | Broken Link |
https://seclists.org/oss-sec/2010/q3/357 | Mailing List Third Party Advisory |
https://security-tracker.debian.org/tracker/CVE-2010-3299 | Third Party Advisory |
https://www.usenix.org/legacy/events/woot10/tech/full_papers/Rizzo.pdf | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 01:18
Type | Values Removed | Values Added |
---|---|---|
References | () https://access.redhat.com/security/cve/cve-2010-3299 - Broken Link | |
References | () https://seclists.org/oss-sec/2010/q3/357 - Mailing List, Third Party Advisory | |
References | () https://security-tracker.debian.org/tracker/CVE-2010-3299 - Third Party Advisory | |
References | () https://www.usenix.org/legacy/events/woot10/tech/full_papers/Rizzo.pdf - Exploit, Third Party Advisory |
Information
Published : 2019-11-12 21:15
Updated : 2024-11-21 01:18
NVD link : CVE-2010-3299
Mitre link : CVE-2010-3299
CVE.ORG link : CVE-2010-3299
JSON object : View
Products Affected
rubyonrails
- rails
debian
- debian_linux
CWE
CWE-311
Missing Encryption of Sensitive Data