Lucene search

K
freebsdFreeBSDE4833927-86E5-11E0-A6B4-000A5E1E33C6
HistoryMay 25, 2011 - 12:00 a.m.

Erlang -- ssh library uses a weak random number generator

2011-05-2500:00:00
vuxml.freebsd.org
8

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

0.002 Low

EPSS

Percentile

60.9%

US-CERT reports:

The Erlang/OTP ssh library implements a number of
cryptographic operations that depend on cryptographically
strong random numbers. Unfortunately the RNG used by the
library is not cryptographically strong, and is further
weakened by the use of predictable seed material. The RNG
(Wichman-Hill) is not mixed with an entropy source.

OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarcherlang<Β r14b03UNKNOWN

7.8 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:C/I:N/A:N

0.002 Low

EPSS

Percentile

60.9%