Beaker Sensitive Information Disclosure vulnerability

中危 4.3CVE-2012-3458 · GHSA-39vm-p9mr-4r27 · PYSEC-2012-1 · Published 15/09/2012 · updated 16/06/2026

Package	Affected versions	Patched versions
beaker PyPI	`< 1.6.4< 1.6.5.post1`	`1.6.41.6.5.post1`
beaker python	`≤ 1.6.4`	No fix yet

Description

Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.

NVD description

Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.

References

nvd.nist.gov/vuln/detail/CVE-2012-3458 · ADVISORY
bbangert/beaker commit 91becae · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
bbangert/beaker · PACKAGE
pypa/advisory-database · WEB
web.archive.org/web/20140724164516/http://secunia.com/advisories/50226 · WEB
web.archive.org/web/20140725025612/http://secunia.com/advisories/50520 · WEB
debian.org/security/2012/dsa-2541 · WEB
openwall.com/lists/oss-security/2012/08/13/10 · WEB
secunia.com/advisories/50226 · Vendor Advisory
secunia.com/advisories/50520 · Vendor Advisory
GitHub Advisory GHSA-39vm-p9mr-4r27 · ADVISORY

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free