Vulnerability Details : CVE-2022-35928
AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prompts. Passwords lengths were not checked before being read. This vulnerability may lead to buffer overruns. This does _not_ affect source code found on aescrypt.com, nor is the vulnerability present when providing a password or a key via the `-p` or `-k` command-line options. The problem was fixed via in commit 68761851b and will be included in release 3.16. Users are advised to upgrade. Users unable to upgrade should us the `-p` or `-k` options to provide a password or key.
Vulnerability category: OverflowInput validation
Products affected by CVE-2022-35928
- cpe:2.3:a:aescrypt:aes_crypt:3.11:*:*:*:*:linux:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-35928
0.03%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 5 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-35928
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.5
|
MEDIUM | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
NIST | |
|
8.4
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
2.5
|
5.9
|
GitHub, Inc. |
CWE ids for CVE-2022-35928
-
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.Assigned by: security-advisories@github.com (Secondary)
-
When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.Assigned by: nvd@nist.gov (Primary)
-
The product receives input that is expected to specify a quantity (such as size or length), but it does not validate or incorrectly validates that the quantity has the required properties.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-35928
-
https://github.com/paulej/AESCrypt/security/advisories/GHSA-r7fv-72pg-fwrq
AES Crypt for Linux Password Security Vulnerability · Advisory · paulej/AESCrypt · GitHubPatch;Third Party Advisory
-
https://github.com/paulej/AESCrypt/commit/68761851b595e96c68c3f46bfc21167e72c6a22c
Fixed security issue with passwords entered via a prompt · paulej/AESCrypt@6876185 · GitHubPatch;Third Party Advisory
Jump to