Junglewise Threat Intelligence

CVE-2012-3458: PYSEC-2012-1 - Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain port

CVE-2012-3458 · Severity: low · CVSS 3.1 · Published 2012-09-15

Vendors: PyPI.

Executive brief

Beaker is a Python session caching and cryptography library commonly used in web applications to secure user session data. When configured to use PyCrypto for encryption, it employed AES in ECB (Electronic Codebook) mode—a cryptographic mode known to leak patterns in encrypted data. An attacker could observe these patterns to infer portions of sensitive session information without the encryption key.

Technical details

The vulnerability exists in Beaker's PyCrypto-based session encryption, which used AES in ECB (Electronic Codebook) cipher mode. ECB mode is cryptographically weak because identical plaintext blocks encrypt to identical ciphertext blocks, leaking information about the plaintext structure. An unauthenticated network attacker can observe the encrypted session data and infer patterns to deduce portions of the session contents. The attack requires no special privileges or user interaction—merely network access to intercept encrypted sessions. The vulnerability was patched in version 1.6.4 by switching to a secure cipher mode (CBC), as documented in the referenced Red Hat patch.

Affected products

  • Beaker Beaker before 1.6.4

Timeline

  • 2012-08-13: disclosed
  • 2022-05-17: advisory

References

Related threats