https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 19:34:02 +0000 https://cve.radiocsirt.org/vuln/cve-2023-43637 <p><strong>Affected:</strong> LF-Edge, Zededa EVE OS, linuxfoundation edge_virtualization_engine</p> <p>Due to the implementation of &#34;deriveVaultKey&#34;, prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be &#34;arfoobarfoobarfo&#34;.</p> <p>This issue happens because &#34;deriveVaultKey&#34; calls &#34;retrieveCloudKey&#34; (which will always return &#34;foobarfoobarfoobarfoobarfoobarfo&#34; as the key), and then merges the 32byte randomly generated key with this key (by takeing 16bytes from each, see &#34;mergeKeys&#34;).</p> <p>This makes the key a lot weaker.</p> <p>This issue does not persist in devices that were initialized on/after version 7.10, but devices that were initialized before that and updated to a newer version still have this issue.</p> <p>Roll an update that enforces the full 32bytes key usage.</p> <p><strong>Affected:</strong> LF-Edge, Zededa EVE OS, linuxfoundation edge_virtualization_engine</p> <p>Due to the implementation of &#34;deriveVaultKey&#34;, prior to version 7.10, the generated vault key would always have the last 16 bytes predetermined to be &#34;arfoobarfoobarfo&#34;.</p> <p>This issue happens because &#34;deriveVaultKey&#34; calls &#34;retrieveCloudKey&#34; (which will always return &#34;foobarfoobarfoobarfoobarfoobarfo&#34; as the key), and then merges the 32byte randomly generated key with this key (by takeing 16bytes from each, see &#34;mergeKeys&#34;).</p> <p>This makes the key a lot weaker.</p> <p>This issue does not persist in devices that were initialized on/after version 7.10, but devices that were initialized before that and updated to a newer version still have this issue.</p> <p>Roll an update that enforces the full 32bytes key usage.</p> https://cve.radiocsirt.org/vuln/cve-2023-43637