CVE-2016-6225

NameCVE-2016-6225
Descriptionxbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6394.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs851244

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
percona-xtrabackup (PTS)jessie2.2.3-2.1vulnerable

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
percona-xtrabackupsource(unstable)(unfixed)851244

Notes

[jessie] - percona-xtrabackup <no-dsa> (Minor issue)
https://www.percona.com/blog/2017/01/12/cve-2016-6225-percona-xtrabackup-encryption-iv-not-set-properly
https://github.com/percona/percona-xtrabackup/pull/266
https://github.com/percona/percona-xtrabackup/pull/267
Search for package or bug name: Reporting problems