GHSA-8xhv-gqm4-3w99
GHSA-8xhv-gqm4-3w99 · ZendFramework1 Potential Insufficient Entropy Vulnerability
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls: ``` Zend_Ldap_Attribute::createPassword Zend_Form_Element_Hash::_generateHash Zend_Gdata_HttpClient::filterHttpRequest Zend_Filter_Encrypt_Mcrypt::_srand Zend_OpenId::randomBytes ``` In each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation. Moreover, we discovered a potential security issue in the usage of the [openssl_random_pseudo_bytes()](http://php.net/manual/en/function.openssl-random-pseudo-bytes.php) function in Zend_Crypt_Math::randBytes, reported in PHP BUG [#70014](https://bugs.php.net/bug.php?id=70014), and the security implications reported in a discussion [on the random_compat library.](https://github.com/paragonie/random_compat/issues/96)
CVSS 7.5 · Hoch · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: php
Betroffene Produkte und Versionen
zendframework/zendframework1 Packagist
- Softwareversionen
- 1.12.0
- 1.12.1
- 1.12.10
- 1.12.11
- 1.12.12
- 1.12.13
- 1.12.14
- 1.12.15
- 1.12.16
- 1.12.17
- 1.12.2
- 1.12.3
- 1.12.4
- 1.12.5
- 1.12.6
- 1.12.7
- 1.12.8
- 1.12.9
- Betroffene Versionsbereiche
- ECOSYSTEM: ≥ 1.12.0, < 1.12.18
Auf 1.12.18 aktualisieren