Insecure Encryption Affecting parsel package, versions >=0.0.0


0.0
high

Snyk CVSS

    Attack Complexity High
    Confidentiality High

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-RUBY-PARSEL-542917
  • published 22 Jan 2020
  • disclosed 22 Jan 2020
  • credit Salesforce Product Security

How to fix?

There is no fixed version for parsel.

Overview

parsel is a gem to encrypt and decrypt data with a given key.

Affected versions of this package are vulnerable to Insecure Encryption. It contains a weak key derivation function, in which a key of arbitrary length is run through one round of SHA256 to gain key material of the correct length. This allows for the use of weak key material without appropriate key stretching.