cloak_ecto
Encrypted fields for Ecto
Activity
- Latest release
- 2y ago
- Total releases
- 8
- Cadence
- ~7 months
- Last 12 months
- 0
Details
- License
- MIT
- First release
- Dec 31, 2018
| Version | Released | |
|---|---|---|
1.3.0
minor
1 CVE
CVE-2026-94206
EEF-CVE-2026-94206
Oct 06, 2026
Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Medium
Network
Low
None
None
SummaryUse of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0. Proof of concept
ImpactAn attacker who obtains a database dump and the PBKDF2 secret can recover hashed values with low entropy, such as email addresses, by offline guessing at a cost far below what the configuration promises. WorkaroundsOverride Affected versions
1.0.0
1.0.0-alpha.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.3.0
References
Updated Oct 06, 2026 · Source: OSV.dev | ||
1.2.0
minor
1 CVE
CVE-2026-94206
EEF-CVE-2026-94206
Oct 06, 2026
Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Medium
Network
Low
None
None
SummaryUse of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0. Proof of concept
ImpactAn attacker who obtains a database dump and the PBKDF2 secret can recover hashed values with low entropy, such as email addresses, by offline guessing at a cost far below what the configuration promises. WorkaroundsOverride Affected versions
1.0.0
1.0.0-alpha.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.3.0
References
Updated Oct 06, 2026 · Source: OSV.dev | ||
1.1.1
patch
1 CVE
CVE-2026-94206
EEF-CVE-2026-94206
Oct 06, 2026
Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Medium
Network
Low
None
None
SummaryUse of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0. Proof of concept
ImpactAn attacker who obtains a database dump and the PBKDF2 secret can recover hashed values with low entropy, such as email addresses, by offline guessing at a cost far below what the configuration promises. WorkaroundsOverride Affected versions
1.0.0
1.0.0-alpha.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.3.0
References
Updated Oct 06, 2026 · Source: OSV.dev | ||
1.1.0
minor
1 CVE
CVE-2026-94206
EEF-CVE-2026-94206
Oct 06, 2026
Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Medium
Network
Low
None
None
SummaryUse of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0. Proof of concept
ImpactAn attacker who obtains a database dump and the PBKDF2 secret can recover hashed values with low entropy, such as email addresses, by offline guessing at a cost far below what the configuration promises. WorkaroundsOverride Affected versions
1.0.0
1.0.0-alpha.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.3.0
References
Updated Oct 06, 2026 · Source: OSV.dev | ||
1.0.2
patch
1 CVE
CVE-2026-94206
EEF-CVE-2026-94206
Oct 06, 2026
Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Medium
Network
Low
None
None
SummaryUse of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0. Proof of concept
ImpactAn attacker who obtains a database dump and the PBKDF2 secret can recover hashed values with low entropy, such as email addresses, by offline guessing at a cost far below what the configuration promises. WorkaroundsOverride Affected versions
1.0.0
1.0.0-alpha.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.3.0
References
Updated Oct 06, 2026 · Source: OSV.dev | ||
1.0.1
patch
1 CVE
CVE-2026-94206
EEF-CVE-2026-94206
Oct 06, 2026
Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Medium
Network
Low
None
None
SummaryUse of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0. Proof of concept
ImpactAn attacker who obtains a database dump and the PBKDF2 secret can recover hashed values with low entropy, such as email addresses, by offline guessing at a cost far below what the configuration promises. WorkaroundsOverride Affected versions
1.0.0
1.0.0-alpha.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.3.0
References
Updated Oct 06, 2026 · Source: OSV.dev | ||
1.0.0
initial
1 CVE
CVE-2026-94206
EEF-CVE-2026-94206
Oct 06, 2026
Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Medium
Network
Low
None
None
SummaryUse of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0. Proof of concept
ImpactAn attacker who obtains a database dump and the PBKDF2 secret can recover hashed values with low entropy, such as email addresses, by offline guessing at a cost far below what the configuration promises. WorkaroundsOverride Affected versions
1.0.0
1.0.0-alpha.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.3.0
References
Updated Oct 06, 2026 · Source: OSV.dev | ||
1.0.0-alpha.0
pre
1 CVE
CVE-2026-94206
EEF-CVE-2026-94206
Oct 06, 2026
Cloak PBKDF2 field ignores the configured iteration count and runs only :size rounds
Medium
Network
Low
None
None
SummaryUse of Password Hash With Insufficient Computational Effort vulnerability in danielberkompas cloak_ecto and danielberkompas cloak allows an attacker who holds the hashed values and the configured secret to brute-force low-entropy plaintexts much faster than configured. The This issue affects cloak_ecto: from 1.0.0-alpha.0 onward; cloak: from 0.7.0 before 1.0.0-alpha.0. Proof of concept
ImpactAn attacker who obtains a database dump and the PBKDF2 secret can recover hashed values with low entropy, such as email addresses, by offline guessing at a cost far below what the configuration promises. WorkaroundsOverride Affected versions
1.0.0
1.0.0-alpha.0
1.0.1
1.0.2
1.1.0
1.1.1
1.2.0
1.3.0
References
Updated Oct 06, 2026 · Source: OSV.dev |