CVE-2016-6485: Unauthenticated crypto and weak IV in Magento\Framework\Encryption

November 20, 2019 (updated February 10, 2025)

The __construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initialization vector, which makes it easier for remote attackers to defeat cryptographic protection mechanisms by guessing the value.

References

github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2016-6485.yaml
github.com/advisories/GHSA-h7qw-mxrm-c6h2
github.com/magento/magento2/pull/15017
nvd.nist.gov/vuln/detail/CVE-2016-6485

Code Behaviors & Features

Detect and mitigate CVE-2016-6485 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →