CVE-2023-43637

<br /> Due to the implementation of "deriveVaultKey", prior to version 7.10, the generated vault key<br /> would always have the last 16 bytes predetermined to be "arfoobarfoobarfo".<br /> <br /> This issue happens because "deriveVaultKey" calls "retrieveCloudKey" (which will always<br /> return "foobarfoobarfoobarfoobarfoobarfo" as the key), and then merges the 32byte<br /> randomly generated key with this key (by takeing 16bytes from each, see "mergeKeys").<br /> <br /> This makes the key a lot weaker.<br /> <br /> This issue does not persist in devices that were initialized on/after version 7.10, but devices<br /> that were initialized before that and updated to a newer version still have this issue.<br /> <br /> <br /> <br /> Roll an update that enforces the full 32bytes key usage.<br /> <br /> <br /> <br /> <br /> <br /> <br />