CVE-2022-31157 Use of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-library
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2022-31157?
CVE-2022-31157 is a high-severity vulnerability in packbackbooks lti-1-3-php-library, published on 15 Jul 2022.
Official description
LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random nonces was not sufficiently cryptographically complex. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds.
Which versions are affected by CVE-2022-31157?
2 open source packages ship an affected version, including packbackbooks/lti-1-3-php-library. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
packbackbooks/lti-1-3-php-library Packagist | All versions | 5.0 |
packbackbooks/lti-1-3-php-library Packagist | All versions | 5.0 |
Products include Packback Lti 1.3 Tool Library.
How do I fix CVE-2022-31157?
Upgrade packbackbooks/lti-1-3-php-library to 5.0 or later.
Is CVE-2022-31157 being exploited?
There is no known exploitation of CVE-2022-31157 in the wild and no public exploit code.
Other vulnerabilities in packbackbooks lti-1-3-php-library
Sources
Also known as GHSA-768m-5w34-2xf5.