| Package | Affected versions | Patched versions |
|---|---|---|
| aescrypt | ≤ 1.0.0 | |
| aescrypt | ≤ 1.0.0 |
The aescrypt gem 1.0.0 for Ruby does not randomize the CBC IV for use with the AESCrypt.encrypt and AESCrypt.decrypt functions, which allows attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free