GHSA-q8fc-v85f-78pw json
stormpath/sdk uses Insecure Random Number Generator
published 2y ago modified last yr.
- cvss
- 5.3
- version 3.1, GitHub
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- —
- no score, EPSS covers CVEs only
- public exploits
- 0
- none known
Summary
The vulnerability pertains to the usage of an insecure random number generator (RNG) in the "stormpath-sdk-php" library. Specifically, the issue is present in the generation of UUID (Universally Unique Identifier) version 4 within the codebase.
Is GHSA-q8fc-v85f-78pw in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | stormpath/sdk | <=1.19.0 |
no fix listed |
Classification
- Weakness
-
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
References
-
github.com
/stormpath/stormpath-sdk-php/issues/132
web
-
github.com
/FriendsOfPHP/security-advisories/blob/master/stormpath/sdk/2017-11-20.yaml
web
-
github.com
/stormpath/stormpath-sdk-php
package
-
github.com
/stormpath/stormpath-sdk-php/blob/15aee3007b8aa41c20cdf28fd650b8a2368a7fa9/src/Util/UUID.php#L167-L181
web
-
github.com
/stormpath/stormpath-sdk-php/blob/62698ea98ef89217f932e28cf3e511d39af3b4cf/src/Authc/Api/ApiKeyEncryptionOptio
web
Sources
- GitHub Advisory GHSA-q8fc-v85f-78pw
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.