GHSA-8xhv-gqm4-3w99
GHSA-8xhv-gqm4-3w99 · ZendFramework1 Potential Insufficient Entropy Vulnerability
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls: ``` Zend_Ldap_Attribute::createPassword Zend_Form_Element_Hash::_generateHash Zend_Gdata_HttpClient::filterHttpRequest Zend_Filter_Encrypt_Mcrypt::_srand Zend_OpenId::randomBytes ``` In each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation. Moreover, we discovered a potential security issue in the usage of the [openssl_random_pseudo_bytes()](http://php.net/manual/en/function.openssl-random-pseudo-bytes.php) function in Zend_Crypt_Math::randBytes, reported in PHP BUG [#70014](https://bugs.php.net/bug.php?id=70014), and the security implications reported in a discussion [on the random_compat library.](https://github.com/paragonie/random_compat/issues/96)
CVSS 7.5 · Alta · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: php
Productos y versiones afectados
zendframework/zendframework1 Packagist
- Versiones
- 1.12.0
- 1.12.1
- 1.12.10
- 1.12.11
- 1.12.12
- 1.12.13
- 1.12.14
- 1.12.15
- 1.12.16
- 1.12.17
- 1.12.2
- 1.12.3
- 1.12.4
- 1.12.5
- 1.12.6
- 1.12.7
- 1.12.8
- 1.12.9
- Intervalos de versiones afectados
- ECOSYSTEM: ≥ 1.12.0, < 1.12.18
Actualiza a 1.12.18