CVE-2015-7764

Advisory

Lemur 0.1.5 includes a fix for CVE-2015-7764: Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
http://www.openwall.com/lists/oss-security/2015/10/20/3
https://github.com/Netflix/lemur/issues/117
https://github.com/kvesteri/sqlalchemy-utils/issues/166

Affected package

Affected versions

Fixed versions

Vulnerability changelog

~~~~~~~~~~~~~~~~~~

* **SECURITY ISSUE**: Switched from use a AES static key to Fernet encryption.
Affects all versions prior to 0.1.5. If upgrading this will require a data migration.
see: `Upgrading Lemur <https://lemur.readthedocs.com/adminstrationUpgradingLemur>`_

Resources

• https://pypi.org/project/lemur
• https://pyup.io/changelogs/lemur/
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7764
• https://github.com/Netflix/lemur/issues/117
• https://github.com/kvesteri/sqlalchemy-utils/issues/166
• http://www.openwall.com/lists/oss-security/2015/10/20/3