Fallos del tipo CWE-327

401 resultados

Uso de algoritmo criptográfico fraco ou quebrado

É quando o código utiliza algoritmos de criptografia que foram comprometidos, obsoletos ou nunca foram seguros (como MD5, DES, SHA-1 em contextos sensíveis). Esses algoritmos permitem que um atacante recupere dados criptografados com esforço computacional viável, invalidando a proteção que deveriam oferecer.

Ejemplo

Uma aplicação bancária que criptografa senhas usando MD5 ou MD5(senha + salt), ou que negocia conexão HTTPS com suporte a TLS 1.0. Em ambos os casos, ferramentas públicas conseguem quebrar a proteção em horas ou minutos.

Cómo mitigar

Use algoritmos atuais: SHA-256+ (ou bcrypt/scrypt) para hashing de senhas, AES-256 para dados em repouso, e TLS 1.2+ (idealmente 1.3) para trânsito. Revise regularmente o padrão NIST ou recomendações do OWASP e retire suporte a algoritmos deprecados das suas dependências e configurações.

CVE-2019-3818LOWThe kube-rbac-proxy container before version 0.4.1 as used in Red Hat OpenShift Container Platform does not honor TLS configurations, allowiEPSS 0.7%CVE-2022-31230HIGHDell PowerScale OneFS, versions 8.2.x-9.2.x, contain broken or risky cryptographic algorithm. A remote unprivileged malicious attacker couldEPSS 0.7%CVE-2021-22738—Use of a Broken or Risky Cryptographic Algorithm vulnerability exists in homeLYnk (Wiser For KNX) and spaceLYnk V2.60 and prior that could cEPSS 0.6%CVE-2020-5229HIGHOpencast stores passwords using outdated MD5 hash algorithmEPSS 0.6%CVE-2022-45195MEDIUMSimpleXMQ before 3.4.0, as used in SimpleX Chat before 4.2, does not apply a key derivation function to intended data, which can interfere wEPSS 0.6%CVE-2024-31510CRITICALAn issue in Open Quantum Safe liboqs v.10.0 allows a remote attacker to escalate privileges via the crypto_sign_signature parameter in the /EPSS 0.6%CVE-2023-30441HIGHIBM Java information disclosureEPSS 0.6%CVE-2024-53845MEDIUMAES/CBC Constant IV Vulnerability in ESPTouch v2EPSS 0.6%CVE-2022-22559HIGHDell PowerScale OneFS, version 9.3.0, contains a use of a broken or risky cryptographic algorithm. An unprivileged network attacker could exEPSS 0.6%CVE-2023-50312MEDIUMIBM WebSphere Application Server Liberty information disclosureEPSS 0.6%CVE-2017-5243—The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key excEPSS 0.6%CVE-2024-22318MEDIUMIBM i Access Client Solutions information disclosureEPSS 0.6%CVE-2013-20003—Z-Wave devices from Sierra Designs (circa 2013) and Silicon Labs (using S0 security) may use a known, shared network key of all zeros, allowEPSS 0.6%CVE-2021-33018HIGHPhilips Vue PACS Use of a Broken or Risky Cryptographic AlgorithmEPSS 0.6%CVE-2021-39182HIGHUse of Password Hash With Insufficient Computational Effort and Use of a Broken or Risky Cryptographic Algorithm and Reversible One-Way Hash in hashing.pyEPSS 0.6%CVE-2021-3979—A key length flaw was found in Red Hat Ceph Storage. An attacker can exploit the fact that the key length is incorrectly passed in an encrypEPSS 0.6%CVE-2024-28980MEDIUMDell RecoverPoint for VMs, version(s) 6.0.x contain(s) a Use of a Broken or Risky Cryptographic Algorithm vulnerability in the SSH. An unautEPSS 0.6%CVE-2022-1252HIGHUse of a Broken or Risky Cryptographic Algorithm in gnuboard/gnuboard5EPSS 0.5%CVE-2026-20833MEDIUMWindows Kerberos Information Disclosure VulnerabilityEPSS 0.5%CVE-2019-0030MEDIUMJuniper ATP: Password hashing uses DES and a hardcoded saltEPSS 0.5%