High
Security advisory
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-7798
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 12:09 UTC · Revision 1
Source evidence
The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.
osv:CVE-2016-7798
Complete source record
{
"id": "c205cfa2056ed7bcf71c10ce1b8172547fb23bc48c5dac4804584eef5cec938b",
"url": "https://osv.dev/vulnerability/CVE-2016-7798",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-7798",
"summary": "The openssl gem for Ruby uses the same initialization vector (IV) in GCM Mode (aes-*-gcm) when the IV is set before the key, which makes it easier for context-dependent attackers to bypass the encryption protection mechanism.",
"evidence": "osv:CVE-2016-7798",
"products": [],
"severity": "high",
"structured": {
"id": "CVE-2016-7798",
"aliases": [
"CVE-2016-7798",
"GHSA-6h88-qjpv-p32m"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/ruby/openssl",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "4ff95439d0b13aac7b9b2e3674f0a6662c715ec6"
},
{
"fixed": "8108e0a6db133f3375608303fdd2083eb5115062"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:ruby-lang:openssl:*:*:*:*:*:ruby:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "2.0.0"
}
],
"source": "CPE_RANGE"
},
{
"range": [
{
"fixed": "8108e0a6db133f3375608303fdd2083eb5115062"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v2.0.0.beta.2",
"v2.0.0.beta.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-7798.json",
"vanir_signatures": [
{
"id": "CVE-2016-7798-0273a448",
"digest": {
"length": 555,
"function_hash": "18836833283231560844724073730829986290"
},
"source": "https://github.com/ruby/openssl/commit/8108e0a6db133f3375608303fdd2083eb5115062",
"target": {
"file": "ext/openssl/ossl_cipher.c",
"function": "ossl_cipher_initialize"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-7798-3f0883d4",
"digest": {
"length": 1827,
"function_hash": "119251954816265579831480709042123290132"
},
"source": "https://github.com/ruby/openssl/commit/8108e0a6db133f3375608303fdd2083eb5115062",
"target": {
"file": "ext/openssl/ossl_cipher.c",
"function": "Init_ossl_cipher"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-7798-3f753bcc",
"digest": {
"length": 953,
"function_hash": "97745084328378698433793456802924644289"
},
"source": "https://github.com/ruby/openssl/commit/8108e0a6db133f3375608303fdd2083eb5115062",
"target": {
"file": "ext/openssl/ossl_cipher.c",
"function": "ossl_cipher_pkcs5_keyivgen"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-7798-6f8c10c2",
"digest": {
"length": 826,
"function_hash": "24065403867100165975165287948377577072"
},
"source": "https://github.com/ruby/openssl/commit/8108e0a6db133f3375608303fdd2083eb5115062",
"target": {
"file": "ext/openssl/ossl_cipher.c",
"function": "ossl_cipher_update"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-7798-86ad5f31",
"digest": {
"length": 1205,
"function_hash": "134827275998405474457279400591891368564"
},
"source": "https://github.com/ruby/openssl/commit/8108e0a6db133f3375608303fdd2083eb5115062",
"target": {
"file": "ext/openssl/ossl_cipher.c",
"function": "ossl_cipher_init"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
},
{
"id": "CVE-2016-7798-b4b5714f",
"digest": {
"threshold": 0.9,
"line_hashes": [
"284585775078716318004365018978382110472",
"5365017270049154351363641420850474801",
"16305382426517432422657327091401525929",
"45775236435836750032013955384362448794",
"320898416230421948790894359680959822504",
"233218199029811107687397305128374648153",
"174365936403433892041030928945825510933",
"245662856679087629139578563929946069546",
"76602010387779961979775043636728469453",
"61739202877602274549608564427681449652",
"245675679155293234987569825675038787823",
"244762464075265980262547110664038213642",
"177500537116465791592083329812154464276",
"290051772895464098146318870571603871847",
"241899318239519525257244678910703344708",
"12416997827316531595897596689505104204",
"321643682912275299927425285911928048629",
"120948984238574514692622200225975649504",
"231909222775174977084090478227193463499",
"37973962927976103226260129785782099491",
"272509562096133768158234272756950863040",
"217090316981509586516234878214595051749",
"116711954544507703641914481499165266556",
"131847170257812238423551080980995337222",
"40641891737914228294330439304346334986",
"297673390402046217904672312803784686712"
]
},
"source": "https://github.com/ruby/openssl/commit/8108e0a6db133f3375608303fdd2083eb5115062",
"target": {
"file": "ext/openssl/ossl_cipher.c"
},
"deprecated": false,
"signature_type": "Line",
"signature_version": "v1"
},
{
"id": "CVE-2016-7798-d7100c6b",
"digest": {
"length": 394,
"function_hash": "329745586785318989411528529045439739679"
},
"source": "https://github.com/ruby/openssl/commit/8108e0a6db133f3375608303fdd2083eb5115062",
"target": {
"file": "ext/openssl/ossl_cipher.c",
"function": "ossl_cipher_set_key"
},
"deprecated": false,
"signature_type": "Function",
"signature_version": "v1"
}
],
"vanir_signatures_modified": "2026-10-20T13:13:21Z"
}
}
],
"modified": "2026-10-20T13:13:21.888428933Z",
"provider": "osv",
"references": [
"https://lists.debian.org/debian-lts-announce/2018/07/msg00012.html",
"https://www.debian.org/security/2017/dsa-3966",
"https://github.com/ruby/openssl/commit/8108e0a6db133f3375608303fdd2083eb5115062",
"https://github.com/ruby/openssl/issues/49"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
],
"vendor_product": "debian:debian_linux",
"extracted_events": [
{
"range": [
{
"introduced": "8.0"
},
{
"last_affected": "8.0"
},
{
"introduced": "9.0"
},
{
"last_affected": "9.0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-7798",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 387323,
"published_at": "2017-01-30T22:59:00.747+00:00"
}