https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:19:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-187580 EUVD-2026-187580 https://cve.radiocsirt.org/vuln/euvd-2026-187580 https://cve.radiocsirt.org/vuln/fkie_cve-2023-43637 <p>Due to the implementation of &#34;deriveVaultKey&#34;, prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be &#34;arfoobarfoobarfo&#34;.</p> <p>This issue happens because &#34;deriveVaultKey&#34; calls &#34;retrieveCloudKey&#34; (which will always return &#34;foobarfoobarfoobarfoobarfoobarfo&#34; as the key), and then merges the 32byte randomly generated key with this key (by takeing 16bytes from each, see &#34;mergeKeys&#34;).</p> <p>This makes the key a lot weaker.</p> <p>This issue does not persist in devices that were initialized on/after version 7.10, but devices that were initialized before that and updated to a newer version still have this issue.</p> <p>Roll an update that enforces the full 32bytes key usage.</p> <p>Due to the implementation of &#34;deriveVaultKey&#34;, prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be &#34;arfoobarfoobarfo&#34;.</p> <p>This issue happens because &#34;deriveVaultKey&#34; calls &#34;retrieveCloudKey&#34; (which will always return &#34;foobarfoobarfoobarfoobarfoobarfo&#34; as the key), and then merges the 32byte randomly generated key with this key (by takeing 16bytes from each, see &#34;mergeKeys&#34;).</p> <p>This makes the key a lot weaker.</p> <p>This issue does not persist in devices that were initialized on/after version 7.10, but devices that were initialized before that and updated to a newer version still have this issue.</p> <p>Roll an update that enforces the full 32bytes key usage.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-43637 https://cve.radiocsirt.org/vuln/ghsa-g7vp-j25f-h34p <p><strong>Affected:</strong> Go: github.com/lf-edge/eve</p> <p>### Impact</p> <p>The deriveVaultKey function calls retrieveCloudKey which always returns &#34;foobarfoobarfoobarfoobarfoobarfo&#34;. When merged with the randomly generated 32-byte key using mergeKeys (16 bytes from each), the last 16 bytes are always &#34;arfoobarfoobarfo&#34;. This enables an attacker with physical access to the EVE-OS device to attempt to brute force the remaining 128 bits of key.</p> <p>### Patches</p> <p>Fixed in 7.10 and 8.12.1-lts</p> <p>### Workarounds</p> <p>None</p> <p><strong>Affected:</strong> Go: github.com/lf-edge/eve</p> <p>### Impact</p> <p>The deriveVaultKey function calls retrieveCloudKey which always returns &#34;foobarfoobarfoobarfoobarfoobarfo&#34;. When merged with the randomly generated 32-byte key using mergeKeys (16 bytes from each), the last 16 bytes are always &#34;arfoobarfoobarfo&#34;. This enables an attacker with physical access to the EVE-OS device to attempt to brute force the remaining 128 bits of key.</p> <p>### Patches</p> <p>Fixed in 7.10 and 8.12.1-lts</p> <p>### Workarounds</p> <p>None</p> https://cve.radiocsirt.org/vuln/ghsa-g7vp-j25f-h34p https://cve.radiocsirt.org/vuln/gsd-2023-43637 gsd-2023-43637 https://cve.radiocsirt.org/vuln/gsd-2023-43637