Bug#922442: There is a security weakness in p7zip password encryption. IV for AES-CBC is generated from a very poor RNG (poorly seeded) and half of it is always zeroes.

Klint Yeastmood Mon, 30 Dec 2019 07:30:38 -0800

Hi, has this bug been fixed? After browsing the source at
https://salsa.debian.org/debian/p7zip it looks to me like it hasn't...


The bug has been reported to Igor Pavlov
(https://sourceforge.net/p/sevenzip/bugs/2176/) and there is a patch
available for p7zip 16.02 backported from 7-Zip 19.00 - see the bug
report.

Thanks

Bug#922442: There is a security weakness in p7zip password encryption. IV for AES-CBC is generated from a very poor RNG (poorly seeded) and half of it is always zeroes.

Reply via email to