2 uses of risky/ broken cryptograhic alogrithm CVE

[s-b-repo]

line #22
// a NoSuchAlgorithmException
} catch (NoSuchMethodError nsme) {
// JamVM, gij
try {
Cipher cipher = Cipher.getInstance("AES/CBC/NoPadding");

The CBC mode used in javax.crypto.Cipher.getInstance does not provide integrity. Consided using Galois/Counter Mode.
[‎core/java/src/net/i2p/crypto/CryptoCheck.java]

line 272
private Cipher acquire() {
Cipher rv = _ciphers.poll();
if (rv == null) {
try {
rv = Cipher.getInstance("AES/CBC/NoPadding");

The CBC mode used in javax.crypto.Cipher.getInstance does not provide integrity. Consided using Galois/Counter Mode.
[‎core/java/src/net/i2p/crypto/CryptixAESEngine.java]

[eyedeekay]

Worth a look. Can you please identify the tool you've been using? I need to see what it's actually looking for.

[s-b-repo]

snyk make a fork

[s-b-repo]

Worth a look. Can you please identify the tool you've been using? I need to see what it's actually looking for.

it uses code analysis