Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might allow remote attackers to obtain portions of sensitive session data via unspecified vectors.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might
    allow remote attackers to obtain portions of sensitive session data via unspecified vectors.
    (CVE-2012-3458)

According to the versions of the python-beaker package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - Beaker before 1.6.4, when using PyCrypto to encrypt sessions, uses AES in ECB cipher mode, which might     allow remote attackers to obtain portions of sensitive session data via unspecified vectors.
    (CVE-2012-3458)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that Beaker, a cache and session library for Python, when using the python-crypto backend, is vulnerable to information disclosure due to a cryptographic weakness related to the use of the AES cipher in ECB mode.

Systems that have the python-pycryptopp package should not be vulnerable, as this backend is preferred over python-crypto.

After applying this update, existing sessions will be invalidated.

ID	Name	Product	Family	Severity
433632	SCA: security update for beaker (GHSA-39vm-p9mr-4r27)	Tenable Cloud Security	SCA Checks	medium
433632	SCA: security update for beaker (GHSA-39vm-p9mr-4r27)	Tenable Self-Hosted Container Security	SCA Checks	medium
154379	EulerOS 2.0 SP3 : python-beaker (EulerOS-SA-2021-2608)	Nessus	Huawei Local Security Checks	high
62012	Debian DSA-2541-1 : beaker - information disclosure	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-3458

medium

Tenable Plugins

medium

medium

high

medium