CWE-323

W sterownikach PLC Allen-Bradley MicroLogix 1100 i MicroLogix 1400 firmy Rockwell Automation wykryto krytyczną podatność polegającą na wielokrotnym używaniu tej samej pary nonce/klucz w procesie szyfrowania. Umożliwia to atakującemu przechwycenie i odtworzenie prawidłowego żądania (atak replay), co w środowiskach przemysłowych może prowadzić do nieautoryzowanego przejęcia kontroli nad urządzeniami.

Apereo CAS w wersjach 7.3.0 – przed 8.0.0-RC6 używa stałego wektora inicjalizującego (IV) złożonego z samych zer w schemacie szyfrowania AES-GCM, co pozwala zdalnemu, nieuwierzytelnionemu atakującemu na odzyskanie jawnego tekstu stanu konwersacji webflow. Podatność jest krytyczna, ponieważ nie wymaga żadnego uwierzytelnienia ani interakcji użytkownika.

Podatność w Discuz! X5.0 umożliwia nieuwierzytelnionemu atakującemu zdalne ominięcie mechanizmu autoryzacji i uzyskanie dostępu do funkcji tworzenia i przywracania kopii zapasowych bazy danych. Luka jest oceniana jako krytyczna (CVSS 9.3) i nie wymaga żadnych uprawnień ani interakcji użytkownika.

Biblioteka Crypt::DSA dla Perl w wersjach przed 1.21 wielokrotnie używała tego samego nonce podczas generowania podpisów DSA, co umożliwia matematyczne odtworzenie klucza prywatnego. Jest to podatność krytyczna, ponieważ kompromituje klucze podpisujące bez żadnej interakcji użytkownika z atakującym.

Biblioteka hpke-js do szyfrowania hybrydowego (HPKE) w wersjach przed 1.7.5 zawiera race condition w publicznym API SenderContext Seal(), który pozwala na wielokrotne użycie tego samego nonce AEAD. Prowadzi to do całkowitej utraty poufności i integralności szyfrowanych wiadomości.

Adversary-induced keystream re-use on TETRA air-interface encrypted traffic using any TEA keystream generator. IV generation is based upon several TDMA frame counters, which are frequently broadcast by the infrastructure in an unauthenticated manner. An active adversary can manipulate the view of these counters in a mobile station, provoking keystream re-use. By sending crafted messages to the MS and analyzing MS responses, keystream for arbitrary frames can be recovered.

strongMan is a management interface for strongSwan, an OpenSource IPsec-based VPN. When storing credentials in the database (private keys, EAP secrets), strongMan encrypts the corresponding database fields. So far it used AES in CTR mode with a global database key. Together with an initialization vector (IV), a key stream is generated to encrypt the data in the database fields. But because strongMan did not generate individual IVs, every database field was encrypted using the same key stream. An attacker that has access to the database can use this to recover the encrypted credentials. In particular, because certificates, which have to be considered public information, are also encrypted using the same mechanism, an attacker can directly recover a large chunk of the key stream, which allows them to decrypt basically all other secrets especially ECDSA private keys and EAP secrets, which are usually a lot shorter. Version 0.2.0 fixes the issue by switching to AES-GCM-SIV encryption with a random nonce and an individually derived encryption key, using HKDF, for each encrypted value. Database migrations are provided to automatically re-encrypt all credentials.

Cryptographic issue may occur while encrypting license data.

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution'), Use of Password Hash With Insufficient Computational Effort vulnerability in rustdesk-client RustDesk Client rustdesk, hbb_common on Windows, MacOS, Linux (Password security module, config encryption, machine UID modules) allows Retrieve Embedded Sensitive Data. This vulnerability is associated with program files hbb_common/src/password_security.Rs, hbb_common/src/config.Rs, hbb_common/src/lib.Rs (get_uuid), machine-uid/src/lib.Rs and program routines symmetric_crypt(), encrypt_str_or_original(), decrypt_str_or_original(), get_uuid(), get_machine_id(). This issue affects RustDesk Client: through 1.4.5.

Philips Hue Bridge HomeKit Accessory Protocol Static Nonce Authentication Bypass Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Philips Hue Bridge. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the SRP authentication mechanism in the HomeKit Accessory Protocol service, which listens on TCP port 8080 by default. The issue results from the use of a static nonce value. An attacker can leverage this vulnerability to bypass authentication on the system. Was ZDI-CAN-28451.

Wi-Fi Protected Access (WPA and WPA2) that supports IEEE 802.11r allows reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, allowing an attacker within radio range to replay, decrypt, or spoof frames.

W systemie zarządzania biletami pretix odkryto łańcuch trzech powiązanych podatności, który pozwala zalogowanemu atakującemu przejąć sesję dowolnego użytkownika backendowego i uzyskać pełny dostęp do danych systemu. Podatność jest szczególnie groźna, ponieważ wymaga jedynie posiadania dostępu do co najmniej jednego eventu w backendzie.

wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and DTLS 1.2 AES-GCM record within a connection is encrypted under an identical key and nonce pair. Reusing a GCM key and nonce discloses the keystream (the XOR of two ciphertexts equals the XOR of their plaintexts, so one known record recovers the others) and leaks the GHASH authentication key, enabling authentication tag forgery. AES-CCM, TLS 1.3, and non-TLS use of the cipher are not affected.

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record. Prior to 1.3.0, ePA 3.x Integration leaves request_counter unchanged in app/vau/VAUProtokoll.py while constructing VAU messages. The frozen client request counter causes the server side to reuse AES-GCM nonce and key combinations across responses. A network attacker who collects repeated ciphertexts can recover the XOR of plaintexts and use predictable inner HTTP headers and JSON fields to recover sensitive data, including patient health records. Repeated nonces can also enable recovery of the GHASH authentication key through the Joux forbidden attack, allowing forged AES-GCM messages and injection of malicious responses. The response-counter check also fails to maintain last_response_counter, weakening replay and ordering validation. This issue is fixed in version 1.3.0.

HCL MyXalytics  is affected by improper management of a static JWT signing secret in the web application, where the secret lacks rotation , introducing a security risk

Due to Nonce reuse, attackers can perform reply attack or decrypt captured packets.

Podatność kryptograficzna w układach Qualcomm Fastconnect polega na stosowaniu statycznego wektora inicjalizacji (IV) w operacji owijania kluczy AES-GCM, co narusza wymóg unikalności IV dla każdego wywołania. Skutkuje to osłabieniem ochrony kryptograficznej i potencjalnym ujawnieniem lub modyfikacją wrażliwych danych.

The AES key utilized in the pairing process between a lock using Sciener firmware and a wireless keypad is not unique, and can be reused to compromise other locks using the Sciener firmware.

HashiCorp Vault and Vault Enterprise transit secrets engine allowed authorized users to specify arbitrary nonces, even with convergent encryption disabled. The encrypt endpoint, in combination with an offline attack, could be used to decrypt arbitrary ciphertext and potentially derive the authentication subkey when using transit secrets engine without convergent encryption. Introduced in 1.6.0 and fixed in 1.14.3, 1.13.7, and 1.12.11.