Search

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

    2 vulnerabilities by Bixilon

    CVE-2024-56141 (GCVE-0-2024-56141)

    Vulnerability from nvd – Published: 2026-07-06 23:17 – Updated: 2026-07-06 23:17
    VLAI
    Title
    Minosoft has IV equal to key
    Summary
    Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager  encryption routine ( CryptManager.kt ) initializes its AES cipher using an initialization vector (IV) that is set equal to the secret key rather than to a sufficiently random value. Because the IV is not random and is derived directly from the key, the encryption is vulnerable to chosen-ciphertext/chosen-plaintext attacks: an attacker who can submit specific messages for encryption can recover the secret key. This affects all versions supporting Minecraft protocol 1.7 and later. No patched version is available, and no known workarounds are available.
    Severity
    5 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
    CWE
    • CWE-329 - Generation of Predictable IV with CBC Mode
    Assigner
    References
    Impacted products
    Vendor Product Version
    Bixilon Minosoft Affected: >= f1ae30e2b046a490026a8413b075685deb795122
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Minosoft",
          "vendor": "Bixilon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= f1ae30e2b046a490026a8413b075685deb795122"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager\u00a0 encryption routine (\u00a0CryptManager.kt\u00a0) initializes its AES cipher using an initialization vector (IV) that is set equal to the secret key rather than to a sufficiently random value. Because the IV is not random and is derived directly from the key, the encryption is vulnerable to chosen-ciphertext/chosen-plaintext attacks: an attacker who can submit specific messages for encryption can recover the secret key. This affects all versions supporting Minecraft protocol 1.7 and later. No patched version is available, and no known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-329",
              "description": "CWE-329: Generation of Predictable IV with CBC Mode",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-06T23:17:54.978Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bixilon/Minosoft/security/advisories/GHSA-rvr6-48rj-c94j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bixilon/Minosoft/security/advisories/GHSA-rvr6-48rj-c94j"
        },
        {
          "name": "https://github.com/Bixilon/Minosoft/blob/3a608abe2d0999e4e702cc1b2d28366884c7f31e/src/main/java/de/bixilon/minosoft/protocol/protocol/encryption/CryptManager.kt#L72",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bixilon/Minosoft/blob/3a608abe2d0999e4e702cc1b2d28366884c7f31e/src/main/java/de/bixilon/minosoft/protocol/protocol/encryption/CryptManager.kt#L72"
        }
      ],
      "source": {
        "advisory": "GHSA-rvr6-48rj-c94j",
        "discovery": "UNKNOWN"
      },
      "title": "Minosoft has IV equal to key"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-56141",
    "datePublished": "2026-07-06T23:17:54.978Z",
    "dateReserved": "2024-12-16T18:04:39.982Z",
    "dateUpdated": "2026-07-06T23:17:54.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2024-56141 (GCVE-0-2024-56141)

    Vulnerability from cvelistv5 – Published: 2026-07-06 23:17 – Updated: 2026-07-06 23:17
    VLAI
    Title
    Minosoft has IV equal to key
    Summary
    Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager  encryption routine ( CryptManager.kt ) initializes its AES cipher using an initialization vector (IV) that is set equal to the secret key rather than to a sufficiently random value. Because the IV is not random and is derived directly from the key, the encryption is vulnerable to chosen-ciphertext/chosen-plaintext attacks: an attacker who can submit specific messages for encryption can recover the secret key. This affects all versions supporting Minecraft protocol 1.7 and later. No patched version is available, and no known workarounds are available.
    Severity
    5 (Medium)
    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
    CWE
    • CWE-329 - Generation of Predictable IV with CBC Mode
    Assigner
    References
    Impacted products
    Vendor Product Version
    Bixilon Minosoft Affected: >= f1ae30e2b046a490026a8413b075685deb795122
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "Minosoft",
          "vendor": "Bixilon",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= f1ae30e2b046a490026a8413b075685deb795122"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Minosoft is an open-source, multi-version Minecraft Java Edition client written in Kotlin. Starting in commit f1ae30e2b046a490026a8413b075685deb795122, the CryptManager\u00a0 encryption routine (\u00a0CryptManager.kt\u00a0) initializes its AES cipher using an initialization vector (IV) that is set equal to the secret key rather than to a sufficiently random value. Because the IV is not random and is derived directly from the key, the encryption is vulnerable to chosen-ciphertext/chosen-plaintext attacks: an attacker who can submit specific messages for encryption can recover the secret key. This affects all versions supporting Minecraft protocol 1.7 and later. No patched version is available, and no known workarounds are available."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-329",
              "description": "CWE-329: Generation of Predictable IV with CBC Mode",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-06T23:17:54.978Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/Bixilon/Minosoft/security/advisories/GHSA-rvr6-48rj-c94j",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/Bixilon/Minosoft/security/advisories/GHSA-rvr6-48rj-c94j"
        },
        {
          "name": "https://github.com/Bixilon/Minosoft/blob/3a608abe2d0999e4e702cc1b2d28366884c7f31e/src/main/java/de/bixilon/minosoft/protocol/protocol/encryption/CryptManager.kt#L72",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/Bixilon/Minosoft/blob/3a608abe2d0999e4e702cc1b2d28366884c7f31e/src/main/java/de/bixilon/minosoft/protocol/protocol/encryption/CryptManager.kt#L72"
        }
      ],
      "source": {
        "advisory": "GHSA-rvr6-48rj-c94j",
        "discovery": "UNKNOWN"
      },
      "title": "Minosoft has IV equal to key"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2024-56141",
    "datePublished": "2026-07-06T23:17:54.978Z",
    "dateReserved": "2024-12-16T18:04:39.982Z",
    "dateUpdated": "2026-07-06T23:17:54.978Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}