OpenSSL gem for Ruby using inadequate encryption strength (GHSA-6h88-qjpv-p32m)
Published: 2017-10-24T18:33:35Z
Aliases: CVE-2016-7798
Severity: HIGH · CWE: CWE-326

The OpenSSL gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.

Affected packages:
package: ecosystem: RubyGems
name: openssl
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 2.0.0