CVE-2024-45751 Weak cryptography in n/a
tgt uses a predictable PRNG seed, allowing attackers to predict challenge sequences and bypass authentication mechanisms.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-45751?
CVE-2024-45751 is a medium-severity vulnerability in n/a, published on 6 Sep 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.
Weakness: CWE-338
Which versions are affected by CVE-2024-45751?
Linux distribution packages (3)
tgt SUSE:Linux Enterprise Module for Basesystem 15 SP6 | All versions | 1.0.85-150600.10.3.1 |
tgt SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.0.85-150600.10.3.1 |
tgt openSUSE:Leap 15.6 | All versions | 1.0.85-150600.10.3.1 |
How do I fix CVE-2024-45751?
Upgrade to a fixed version.
Is CVE-2024-45751 being exploited?
There is no known exploitation of CVE-2024-45751 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2024-45751, DLA-3976-1, GHSA-cwq5-xwx7-85wm, MGASA-2024-0304, OESA-2024-2156, SUSE-SU-2025:02591-1 and 4 more.