GHSA-848f-mph5-9pm9
GHSA-848f-mph5-9pm9 · Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
In Zend Framework, Zend_Captcha_Word (v1) and Zend\Captcha\Word (v2) generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal array_rand() function. This function does not generate sufficient entropy due to its usage of rand() instead of more cryptographically secure methods such as openssl_pseudo_random_bytes(). This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.
CVSS 7.5 · Élevée · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
zendframework/zendframework1 Packagist
- Versions du logiciel
- 1.12.0
- 1.12.1
- 1.12.10
- 1.12.11
- 1.12.12
- 1.12.13
- 1.12.14
- 1.12.15
- 1.12.16
- 1.12.2
- 1.12.3
- 1.12.4
- 1.12.5
- 1.12.6
- 1.12.7
- 1.12.8
- 1.12.9
- Plages de versions concernées
- ECOSYSTEM: ≥ 1.12.0, < 1.12.17
Mettez à jour vers 1.12.17