97 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-8798
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any...
Infinite loop
Overview Affected versions of this package are vulnerable to Infinite loop due to the lack of a limit in the retry mechanism for CPU entropy instructions in the native entropy source. An attacker can cause the application to hang indefinitely by triggering persistent failures in the on-chip entro...
CVE-2026-8798
In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...
UBUNTU-CVE-2026-8798
In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...
CVE-2026-8798
CVE-2026-8798 affects Bouncy Castle for Java FIPS (BC-FJA) prior to bc-fips 2.1.3. The native entropy source on Intel platforms looped unbounded when RDSEED/RDRAND failed, risking a thread hang and potential denial of service as any operation using the native entropy source could stall. The fixes...
CVE-2026-8798 Native entropy source retries the CPU entropy instructions without limit
In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...
EUVD-2026-54725
In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...
CVE-2026-8798
In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...
CVE-2026-8798 Native entropy source retries the CPU entropy instructions without limit
In Bouncy Castle for Java FIPS BC-FJA before bc-fips 2.1.3, the native entropy source used on Intel platforms retried the CPU entropy instructions without any bound. RDSEED and RDRAND report failure through their carry flag, and the JNI seeding routine spun re-issuing the instruction for as long ...
PT-2026-69160
Name of the Vulnerable Software and Affected Versions Bouncy Castle for Java FIPS BC-FJA versions prior to 2.1.3 Description On Intel platforms, the native entropy source retries CPU entropy instructions without a bound. The JNI seeding routine continuously re-issues instructions as long as the...
crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain
Summary CryptoJS.lib.WordArray.random in affected versions is not a cryptographically secure random number generator. Nominal requests for 128 or 256 bits of entropy produce effective search spaces of approximately 2^39 and 2^47 possibilities — small enough to enumerate on commodity hardware...
CVE-2026-18536 Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...
CVE-2026-18536 Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...
CVE-2026-18536
The Data::Entropy Perl module (versions before 0.010 ) is vulnerable to an interception attack because it retrieves remote entropy sources via plain HTTP . Specifically, the Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo sources are accessed without encryption...
EUVD-2026-51803
Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...
PT-2026-67133
Name of the Vulnerable Software and Affected Versions Data::Entropy versions prior to 0.010 Description Remote entropy sources are accessed over plain HTTP, which allows an on-path attacker to substitute the response. This enables the attacker to control the bytes returned by the rand bits and ra...
[SECURITY] Fedora 44 Update: haveged-1.9.22-1.fc44
A Linux entropy source using the HAVEGE algorithm Haveged is a user space entropy daemon which is not dependent upon the standard mechanisms for harvesting randomness for the system entropy pool. This is important in systems with high entropy needs or limited user interaction e.g. headless server...
[SECURITY] Fedora 43 Update: haveged-1.9.22-1.fc43
A Linux entropy source using the HAVEGE algorithm Haveged is a user space entropy daemon which is not dependent upon the standard mechanisms for harvesting randomness for the system entropy pool. This is important in systems with high entropy needs or limited user interaction e.g. headless server...
Smolder 安全漏洞
Smolder is a smoke testing report platform developed by WONKO’s individual developers. Versions of Smolder 1.51 and earlier contain security vulnerabilities. These vulnerabilities stem from the use of the insecure rand function as the default entropy source in encryption functions, which may lead...