This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2022-35928 | BDVDB-2026-181502 Detail

paulejAESCrypt

Description#

AES Crypt is a file encryption software for multiple platforms. AES Crypt for Linux built using the source on GitHub and having the version number 3.11 has a vulnerability with respect to reading user-provided passwords and confirmations via command-line prompts. Passwords lengths were not checked before being read. This vulnerability may lead to buffer overruns. This does _not_ affect source code found on aescrypt.com, nor is the vulnerability present when providing a password or a key via the `-p` or `-k` command-line options. The problem was fixed via in commit 68761851b and will be included in release 3.16. Users are advised to upgrade. Users unable to upgrade should us the `-p` or `-k` options to provide a password or key.

Impact#

Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: local.

Weaknesses#

  • CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.