[PDFBOX-4191] Initialization vectors should be randomly generated for proper security guarantees

• Type: Bug
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 2.0.9, 3.0.0 PDFBox
• Component/s: Crypto
• External issue URL: https://github.com/TomRoush/PdfBox-Android/issues/152
• Assignee: Andreas Lehmkühler
• Reporter: Andreas Lehmkühler
• Created: 16/Apr/18 16:52
• Updated: 16/Apr/18 16:52

Description

Rumen Paletov creates the following issue for Android-Pdfbox on github:

As part of some research about the common crypto mistakes that developers make, I noticed that your application has one of them.

In StandardSecurityHandler.prepareEncryptionDictRev6 you're initializing Cipher instances with a static IV of 0s which is insecure. More details about this issue and how to fix it are available here.

This is true for "our" PDFBox as well