CVE-2012-2146 | Vulnerability Database | Aqua Security

Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique initialization vector (IV), which makes it easier for context-dependent users to obtain sensitive information and decrypt the database.

Affected Software

Name	Vendor	Start Version	End Version
Elixir	Ematia	0.8.0 (including)	0.8.0 (including)
Elixir	Ubuntu	artful	*
Elixir	Ubuntu	hardy	*
Elixir	Ubuntu	lucid	*
Elixir	Ubuntu	natty	*
Elixir	Ubuntu	oneiric	*
Elixir	Ubuntu	precise	*
Elixir	Ubuntu	quantal	*
Elixir	Ubuntu	raring	*
Elixir	Ubuntu	saucy	*
Elixir	Ubuntu	trusty	*
Elixir	Ubuntu	upstream	*
Elixir	Ubuntu	utopic	*
Elixir	Ubuntu	vivid	*
Elixir	Ubuntu	wily	*
Elixir	Ubuntu	xenial	*
Elixir	Ubuntu	yakkety	*
Elixir	Ubuntu	zesty	*

References

http://elixir.ematia.de/trac/ticket/119
http://groups.google.com/group/sqlelixir/browse_thread/thread/efc16227514cffa?pli=1
http://www.openwall.com/lists/oss-security/2012/04/27/8
http://www.openwall.com/lists/oss-security/2012/04/28/2
http://www.openwall.com/lists/oss-security/2012/04/29/1
https://bugzilla.redhat.com/show_bug.cgi?id=810013

NVD	https://nvd.nist.gov/vuln/detail/CVE-2012-2146
CWE	https://cwe.mitre.org/data/definitions/310.html