Vulnerability Description
The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Magento | Magento2 | - |
Related Weaknesses (CWE)
References
- http://www.openwall.com/lists/oss-security/2016/07/19/3Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/07/27/14Mailing ListThird Party Advisory
- https://github.com/magento/magento2/pull/15017
- http://www.openwall.com/lists/oss-security/2016/07/19/3Mailing ListThird Party Advisory
- http://www.openwall.com/lists/oss-security/2016/07/27/14Mailing ListThird Party Advisory
- https://github.com/magento/magento2/pull/15017
FAQ
What is CVE-2016-6485?
CVE-2016-6485 is a vulnerability with a CVSS score of 7.5 (HIGH). The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers...
How severe is CVE-2016-6485?
CVE-2016-6485 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2016-6485?
Check the references section above for vendor advisories and patch information. Affected products include: Magento Magento2.