CVE-2017-12871

The aesEncrypt method in lib/SimpleSAML/Utils/Crypto.php in SimpleSAMLphp 1.14.x through 1.14.11 makes it easier for context-dependent attackers to bypass the encryption protection mechanism by leveraging use of the first 16 bytes of the secret key as the initialization vector (IV).

• CWE-326

• https://github.com/simplesamlphp/simplesamlphp/commit/77df6a932d46daa35e364925eb73a175010dc904Issue Tracking, Patch, Third Party Advisory
• https://simplesamlphp.org/security/201703-02Issue Tracking, Patch, Third Party Advisory
• https://github.com/simplesamlphp/simplesamlphp/commit/77df6a932d46daa35e364925eb73a175010dc904Issue Tracking, Patch, Third Party Advisory
• https://simplesamlphp.org/security/201703-02Issue Tracking, Patch, Third Party Advisory

Published

Sep 1, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-12865Stack-based buffer overflow in "dnsproxy.c" in connman 1.34 …9.8
• CVE-2017-12867The SimpleSAML_Auth_TimeLimitedToken class in SimpleSAMLphp …
• CVE-2017-12868The secureCompare method in lib/SimpleSAML/Utils/Crypto.php …
• CVE-2017-12869The multiauth module in SimpleSAMLphp 1.14.13 and earlier al…
• CVE-2017-1287IBM Rhapsody DM 5.0 and 6.0 could allow a remote attacker to…
• CVE-2017-12870SimpleSAMLphp 1.14.12 and earlier make it easier for man-in-…
• CVE-2017-12872The (1) Htpasswd authentication source in the authcrypt modu…
• CVE-2017-12873SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to…
• CVE-2017-12874The InfoCard module 1.0 for SimpleSAMLphp allows attackers t…
• CVE-2017-12875The WritePixelCachePixels function in ImageMagick 7.0.6-6 al…
• CVE-2017-12876Heap-based buffer overflow in enhance.c in ImageMagick befor…6.5
• CVE-2017-12877Use-after-free vulnerability in the DestroyImage function in…6.5