CVE-2016-7798
Fixed in a distro release EPSS 3%
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
Products: ruby-lang openssl, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | openssl | 2.0.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | ruby-attr-encrypted | 3.0.1-2 |
| Debian 12 | ruby-encryptor | 3.0.0-1 |
| Debian 13 | ruby-attr-encrypted | 3.0.1-2 |
| Debian 13 | ruby-encryptor | 3.0.0-1 |
| Debian 14 | ruby-attr-encrypted | 3.0.1-2 |
| Debian 14 | ruby-encryptor | 3.0.0-1 |
| Debian 8 | ruby2.1 | 2.1.5-2+deb8u4 |
| Debian 9 | ruby2.3 | 2.3.3-1+deb9u1 |
| SUSE Enterprise Storage 5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE HPE Helion OpenStack 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-BCL | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP2-LTSS | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server 12 SP3-BCL | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP3-LTSS | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP2 | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE Linux Enterprise Software Development Kit 12 SP5 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud 7 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud 7 | yast2-ruby-bindings | 3.1.53-9.8.1 |
| SUSE OpenStack Cloud 8 | ruby2.1 | 2.1.9-19.3.2 |
| SUSE OpenStack Cloud Crowbar 8 | ruby2.1 | 2.1.9-19.3.2 |
| Ubuntu 14.04 LTS | ruby1.9.1 | 1.9.3.484-2ubuntu1.3 |
| Ubuntu 14.04 LTS | ruby2.0 | 2.0.0.484-1ubuntu2.4 |
| Ubuntu 16.04 LTS | ruby-attr-encrypted | no fix |
| Ubuntu 16.04 LTS | ruby-encryptor | no fix |
| Ubuntu 16.04 LTS | ruby2.3 | 2.3.1-2~16.04.2 |