Package: cairo-dock-core Version: 3.4.1-3 Severity: important Tags: security upstream
While looking into something else I noticed that cairo-dock is using single DES encryption (via the C library functions setkey() and encrypt()) to store passwords: see https://sources.debian.org/src/cairo-dock/3.4.1-3/src/gldit/cairo-dock-config.c/?hl=526#L487 This is insecure for several reasons, most importantly because DES itself can be broken by brute force on modern hardware, and because it doesn't support passwords longer than eight characters. cairo_dock_{encrypt,decrypt}_string need to be changed to use a modern cipher and operation mode designed for storage of secrets on disk, and to support arbitrary-length passwords. (Note, I do not use cairo-dock myself and do not have it installed. I found this problem by searching through the source code.) -- System Information: Debian Release: buster/sid APT prefers unstable APT policy: (500, 'unstable'), (500, 'stable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 4.19.0-1-amd64 (SMP w/8 CPU cores) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages cairo-dock-core depends on: ii libatk1.0-0 2.30.0-2 ii libc6 2.28-5 ii libcairo-gobject2 1.16.0-2 ii libcairo2 1.16.0-2 ii libcurl3-gnutls 7.62.0-1 ii libdbus-1-3 1.12.12-1 ii libdbus-glib-1-2 0.110-3 ii libfribidi0 1.0.5-3.1 ii libgdk-pixbuf2.0-0 2.38.0+dfsg-7 ii libgl1 1.1.0-1 ii libgl1-mesa-glx 18.2.8-2 ii libglib2.0-0 2.58.2-3 ii libglu1-mesa [libglu1] 9.0.0-2.1 ii libgtk-3-0 3.24.3-1 ii libpango-1.0-0 1.42.4-6 ii libpangocairo-1.0-0 1.42.4-6 ii librsvg2-2 2.44.10-1 ii libwayland-client0 1.16.0-1 ii libx11-6 2:1.6.7-1 ii libxcomposite1 1:0.4.4-2 ii libxinerama1 2:1.1.4-1 ii libxml2 2.9.4+dfsg1-7+b3 ii libxrandr2 2:1.5.1-1 ii libxrender1 1:0.9.10-1 ii libxtst6 2:1.2.3-1 Versions of packages cairo-dock-core recommends: pn cairo-dock-plugins <none> ii curl 7.62.0-1 Versions of packages cairo-dock-core suggests: pn empathy <none> pn f-spot <none> ii gimp 2.10.8-2 ii gnome-calculator 3.30.1-2 ii inkscape 0.92.3-7+b1 pn xcompmgr <none>
