Executive brief
Beaker is a Python session caching and cryptography library commonly used in web applications to secure user session data. When configured to use PyCrypto for encryption, it employed AES in ECB (Electronic Codebook) mode—a cryptographic mode known to leak patterns in encrypted data. An attacker could observe these patterns to infer portions of sensitive session information without the encryption key.
Technical details
The vulnerability exists in Beaker's PyCrypto-based session encryption, which used AES in ECB (Electronic Codebook) cipher mode. ECB mode is cryptographically weak because identical plaintext blocks encrypt to identical ciphertext blocks, leaking information about the plaintext structure. An unauthenticated network attacker can observe the encrypted session data and infer patterns to deduce portions of the session contents. The attack requires no special privileges or user interaction—merely network access to intercept encrypted sessions. The vulnerability was patched in version 1.6.4 by switching to a secure cipher mode (CBC), as documented in the referenced Red Hat patch.
Affected products
- Beaker Beaker before 1.6.4
Timeline
- 2012-08-13: disclosed
- 2022-05-17: advisory