Insecure Random Number Generation

2018-09-0306:30:28

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.002 Low

EPSS

Percentile

53.8%

JSON

akka-remote is vulnerable to insecure random number generation. When a custom random number generator is configured, if the AES128CounterSecureRNG and AES256CounterSecureRNG are enabled, a malicious user can easily guess the random number used during encryption and possibly eavesdrop onto ongoing communications. This is due a bug in the AES128CounterSecureRNG and AES256CounterSecureRNG implementations, causing the generated numbers to repeat themselves after a few bytes.

CPENameOperatorVersion
akka-remotele2.5.15
akka-remotele2.5.15
akka-remotele2.5.15

Name	Operator	Version
akka-remote	le	2.5.15
akka-remote	le	2.5.15
akka-remote	le	2.5.15

References

doc.akka.io/docs/akka/current/security/2018-08-29-aes-rng.html

github.com/akka/akka/commit/56498e7e58e4ee0da94783bf6ec18425ce250ea4

github.com/akka/akka/issues/25553

0.002 Low

EPSS

Percentile

53.8%

JSON

Related for VERACODE:7406