GHSA-8xhv-gqm4-3w99
GHSA-8xhv-gqm4-3w99 · ZendFramework1 Potential Insufficient Entropy Vulnerability
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls: ``` Zend_Ldap_Attribute::createPassword Zend_Form_Element_Hash::_generateHash Zend_Gdata_HttpClient::filterHttpRequest Zend_Filter_Encrypt_Mcrypt::_srand Zend_OpenId::randomBytes ``` In each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation. Moreover, we discovered a potential security issue in the usage of the [openssl_random_pseudo_bytes()](http://php.net/manual/en/function.openssl-random-pseudo-bytes.php) function in Zend_Crypt_Math::randBytes, reported in PHP BUG [#70014](https://bugs.php.net/bug.php?id=70014), and the security implications reported in a discussion [on the random_compat library.](https://github.com/paragonie/random_compat/issues/96)
CVSS 7.5 · Élevée · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: php
Produits et versions concernés
zendframework/zendframework1 Packagist
- Versions du logiciel
- 1.12.0
- 1.12.1
- 1.12.10
- 1.12.11
- 1.12.12
- 1.12.13
- 1.12.14
- 1.12.15
- 1.12.16
- 1.12.17
- 1.12.2
- 1.12.3
- 1.12.4
- 1.12.5
- 1.12.6
- 1.12.7
- 1.12.8
- 1.12.9
- Plages de versions concernées
- ECOSYSTEM: ≥ 1.12.0, < 1.12.18
Mettez à jour vers 1.12.18