Medium severity5.9NVD Advisory· Published Mar 23, 2017· Updated Jun 17, 2026
CVE-2016-6225
CVE-2016-6225
Description
xbcrypt in Percona XtraBackup before 2.3.6 and 2.4.x before 2.4.5 does not properly set the initialization vector (IV) for encryption, which makes it easier for context-dependent attackers to obtain sensitive information from encrypted backup files via a Chosen-Plaintext attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-6394.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
12cpe:2.3:a:percona:xtrabackup:*:*:*:*:*:*:*:*+ 6 more
- cpe:2.3:a:percona:xtrabackup:*:*:*:*:*:*:*:*range: <=2.3.5
- cpe:2.3:a:percona:xtrabackup:2.4.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:percona:xtrabackup:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:percona:xtrabackup:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:percona:xtrabackup:2.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:percona:xtrabackup:2.4.4:*:*:*:*:*:*:*
- (no CPE)range: <2.3.6, <2.4.5
cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:24:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:25:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
8- bugs.launchpad.net/percona-xtrabackup/+bug/1643949nvdIssue TrackingPatchThird Party Advisory
- github.com/percona/percona-xtrabackup/pull/266nvdIssue TrackingPatchThird Party Advisory
- github.com/percona/percona-xtrabackup/pull/267nvdIssue TrackingPatchThird Party Advisory
- lists.opensuse.org/opensuse-updates/2017-01/msg00125.htmlnvdThird Party Advisory
- lists.opensuse.org/opensuse-updates/2017-01/msg00126.htmlnvdThird Party Advisory
- www.percona.com/blog/2017/01/12/cve-2016-6225-percona-xtrabackup-encryption-iv-not-set-properly/nvdVendor Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BAHI6ETS22FJCMLW7A6SICFKQXF5G2VI/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZBVCP6KLFVGG6HSGLHLTMZRD6C4IJSZP/nvd
News mentions
0No linked articles in our index yet.