glibc 安全漏洞

glibc GNU C Library is a C standard library implemented by a GNU project of the GNU community. A security vulnerability exists in glibc version 2.40-12.fc41, which stems from a bug in the implementation of the getrandom function on the ppc64le architecture, resulting in an inability to generate a...

MGASA-2024-0304 Updated tgt packages fix security vulnerability

tgt aka Linux target framework before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical. CVE-2024-45751...

GO-2022-0368 Improper random number generation in github.com/coredns/coredns

Improper random number generation in github.com/coredns/coredns...

Insufficient Entropy In Random Number Generation

zendframework/zendframework1 is vulnerable to insufficient entropy in random number generation. The vulnerability is due to the use of rand or mtrand, which cannot generate cryptographically secure values, leading to potential information disclosure should an attacker be able to brute force the...

GHSA-8XHV-GQM4-3W99 ZendFramework1 Potential Insufficient Entropy Vulnerability

We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls: ZendLdapAttribute::createPassword ZendFormElementHash::generateHash ZendGdataHttpClient::filterHttpRequest...

Zend-Captcha Information Disclosure and Insufficient Entropy vulnerability

In Zend Framework, ZendCaptchaWord v1 and Zend\Captcha\Word v2 generate a "word" for a CAPTCHA challenge by selecting a sequence of random letters from a character set. Prior to this advisory, the selection was performed using PHP's internal arrayrand function. This function does not generate...

Insufficient Entropy In Random Number Generation

paragonie/randomcompat is vulnerable to insufficient entropy in random number generation. The vulnerability is due to the insecure usage of Cryptographically Secure Pseudo-Random Number Generators CSPRNG involving opensslrandompseudobytes, which may compromise the security of generated random...

EulerOS 2.0 SP11 : c-ares (EulerOS-SA-2023-2833)

According to the versions of the c-ares package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will not be set, as...

Oracle Linux 9 : c-ares (ELSA-2023-6635)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6635 advisory. - Resolves: rhbz2209564 - CVE-2023-31124 c-ares: AutoTools does not set CARESRANDOMFILE during cross compilation rhel-9 - Resolves: rhbz2209556 -...

RHEL 9 : c-ares (RHSA-2023:6635)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6635 advisory. The c-ares C library defines asynchronous DNS Domain Name System requests and provides name resolving API. The following packages have been...

GLSA-202310-09 : c-ares: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202310-09 c-ares: Multiple Vulnerabilities - c-ares is an asynchronous resolver library. When cross-compiling c-ares and using the autotools build system, CARESRANDOMFILE will not be set, as seen when cross compiling aarch64...

Oracle Linux 6 : ruby (ELSA-2011-1581)

The remote Oracle Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2011-1581 advisory. - Update to Ruby 1.8.7-p352. Remove Patch43: ruby-1.8.7-CVE-2011-1004.patch; subsumed Remove Patch44: ruby-1.8.7-CVE-2011-1005.patch; subsumed Remove...

CVE-2023-4344

Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection...

CVE-2020-36732

The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more predictable than necessary...

CLSA-2023-1685630287 samba: Fix of CVE-2022-1615

CVE-2022-1615: util/genrand: don't ignore errors in random number generation...

Fedora 37 : c-ares (2023-ae97529c00)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-ae97529c00 advisory. Update to 1.19.1. Fixes CVE-2023-32067, CVE-2023-31130, CVE-2023-31147, CVE-2023-31124 Tenable has extracted the preceding description block directl...

Upgraded Q -> 2 from #245 [1681331462696]

Judge has assessed an item in Issue 245 as 2 risk. The relevant finding follows: 3. Insecure random number generation: Link : The current implementation of the drawing function uses a simple modulo operation with the seed as an argument, which can be easily predicted by attackers. I recommend usi...

Use of timestamp for comparisons

Lines of code Vulnerability details Impact The timestamp in use can be manipulated causing a logic bug in the checks performed Proof of Concept Tools Used slither Recommended Mitigation Steps use random number generation --- The text was updated successfully, but these errors were encountered: Al...

GSD-2023-1001231 efi: random: combine bootloader provided RNG seed with RNG protocol output

efi: random: combine bootloader provided RNG seed with RNG protocol output This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.10.163 by commit...

CVE-2016-15005 Cryptographically weak random number generation in github.com/dinever/golf

CSRF tokens are generated using math/rand, which is not a cryptographically secure random number generator, allowing an attacker to predict values and bypass CSRF protections with relatively few requests...