CVE-2018-11045 Weak cryptography in Pivotal Operations Manager
Attackers can predict the initial random number generator state by using a static seed file embedded in the appliance image, compromising cryptographic security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-11045?
CVE-2018-11045 is a medium-severity vulnerability in Pivotal Operations Manager, published on 11 Jul 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator (LRNG) seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the contents of the corresponding seed from the published image and therefore infer the initial state of the LRNG.
Weakness: CWE-330
Which versions are affected by CVE-2018-11045?
It affects 1 product.
Products include Pivotal Software Operations Manager.
How do I fix CVE-2018-11045?
No fix has been published for CVE-2018-11045 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-11045 being exploited?
There is no known exploitation of CVE-2018-11045 in the wild and no public exploit code.
Other vulnerabilities in Pivotal Operations Manager
- CVE-2016-0883 Auth bypass in n/a
- CVE-2016-0897 Security feature bypass in n/a
- CVE-2018-15762 Pivotal Operations Manager gives all users heightened privileges
- CVE-2019-11292 Pivotal Ops Manager logs query parameters in tomcat access file
- CVE-2018-11081 Pivotal Operations Manager UAA config - temp Ram Disk
Sources
Also known as GHSA-2m5c-4ccv-xpr3.