CVE-2018-1000620 Insufficient Entropy in cryptiles
Insufficient entropy in randomDigits allows attackers to brute force values intended to be random, affecting applications using the cryptiles library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-1000620?
CVE-2018-1000620 is a critical vulnerability in n/a, published on 9 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.
Weakness: CWE-331
Which versions are affected by CVE-2018-1000620?
4 open source packages ship an affected version, including cryptiles. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cryptiles npm | From 3.1.0 | 3.1.3 |
cryptiles npm | From 3.1.0 | 3.1.3 |
cryptiles npm | From 4.0.0 | 4.1.2 |
cryptiles npm | From 4.0.0 | 4.1.2 |
Products include Cryptiles Project Cryptiles.
How do I fix CVE-2018-1000620?
Upgrade cryptiles to a fixed version for your release line: 3.1.3 or 4.1.2.
Is CVE-2018-1000620 being exploited?
There is no known exploitation of CVE-2018-1000620 in the wild and no public exploit code.
Sources
Also known as GHSA-rq8g-5pc5-wrhr.