Bug 434576 – <dev-python/elixir-0.7.1-r1: Information disclosure (CVE-2012-2146)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description GLSAMaker/CVETool Bot 2012-09-10 12:14:50 UTC]

CVE-2012-2146 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-2146):
  Elixir 0.8.0 uses Blowfish in CFB mode without constructing a unique
  initialization vector (IV), which makes it easier for context-dependent
  users to obtain sensitive information and decrypt the database.

[Comment 1 Ian Delaney (RETIRED) 2012-11-12 15:08:35 UTC]

revbumped with security patch CVE-2012-2146 added to files, 

dev-python/elixir $ ebuild elixir-0.7.1-r1.ebuild clean install
running install_scripts
>>> Completed installing elixir-0.7.1-r1 into /mnt/gen2/TmpDir/portage/dev-python/elixir-0.7.1-r1/image/

runs fine

[Comment 2 Sean Amoss (RETIRED) 2012-11-13 00:14:10 UTC]

(In reply to comment #1)
> revbumped with security patch CVE-2012-2146 added to files, 
> 
> dev-python/elixir $ ebuild elixir-0.7.1-r1.ebuild clean install
> running install_scripts
> >>> Completed installing elixir-0.7.1-r1 into /mnt/gen2/TmpDir/portage/dev-python/elixir-0.7.1-r1/image/
> 
> runs fine

Thanks, Ian. Please don't forget to drop the vulnerable version. 

Closing noglsa for ~arch only.