GHSA-8xhv-gqm4-3w99 ZendFramework1 Potential Insufficient Entropy Vulnerability
Insufficient entropy in random number generation allows attackers to predict values, potentially leading to information disclosure or security bypasses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-8xhv-gqm4-3w99?
GHSA-8xhv-gqm4-3w99 is a vulnerability in zendframework/zendframework1, published on 7 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
We discovered several methods used to generate random numbers in ZF1 that potentially used insufficient entropy. These random number generators are used in the following method calls:
Zend_Ldap_Attribute::createPassword
Zend_Form_Element_Hash::_generateHash
Zend_Gdata_HttpClient::filterHttpRequest
Zend_Filter_Encrypt_Mcrypt::_srand
Zend_OpenId::randomBytes
In each case, the methods were using rand() or mt_rand(), neither of which can generate cryptographically secure values. This could potentially lead to information disclosure should an attacker be able to brute force the random number generation.
Moreover, we discovered a potential security issue in the usage of the openssl_random_pseudo_bytes() function in Zend_Crypt_Math::randBytes, reported in PHP BUG #70014, and the security implications reported in a discussion on the random_compat library.
Which versions are affected by GHSA-8xhv-gqm4-3w99?
2 open source packages ship an affected version, including zendframework/zendframework1.
| Package | Affected | Fixed in |
|---|---|---|
zendframework/zendframework1 Packagist | From 1.12.0 | 1.12.18 |
zendframework/zendframework1 Packagist | From 1.12.0 | 1.12.18 |
How do I fix GHSA-8xhv-gqm4-3w99?
Upgrade zendframework/zendframework1 to 1.12.18 or later.
Is GHSA-8xhv-gqm4-3w99 being exploited?
There is no known exploitation of GHSA-8xhv-gqm4-3w99 in the wild and no public exploit code.