CWE-330
DiscouragedUse of Insufficiently Random Values
Abstraction: Class · Status: Stable
The product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.
478 vulnerabilities reference this CWE, most recent first.
GHSA-72P8-V4HG-V45P
Vulnerability from github – Published: 2022-06-01 19:50 – Updated: 2022-06-15 18:57During an X25519 key exchange, the client’s private is generated with System.Random:
var rnd = new Random();
_privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];
rnd.NextBytes(_privateKey);
Source: KeyExchangeECCurve25519.cs
Source commit: https://github.com/sshnet/SSH.NET/commit/b58a11c0da55da1f5bad46faad2e9b71b7cb35b3
System.Random is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes.
Impact
When establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with a weak random number generator whose seed can be bruteforced. This allows an attacker able to eavesdrop the communications to decrypt them.
Workarounds
To ensure you're not affected by this vulnerability, you can disable support for curve25519-sha256 and curve25519-sha256@libssh.org key exchange algorithms by invoking the following method before a connection is established:
private static void RemoveUnsecureKEX(BaseClient client)
{
client.ConnectionInfo.KeyExchangeAlgorithms.Remove("curve25519-sha256");
client.ConnectionInfo.KeyExchangeAlgorithms.Remove("curve25519-sha256@libssh.org");
}
Thanks
This issue was initially reported by Siemens AG, Digital Industries, shortly followed by @yaumn-synacktiv.
{
"affected": [
{
"package": {
"ecosystem": "NuGet",
"name": "SSH.NET"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2020.0.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-29245"
],
"database_specific": {
"cwe_ids": [
"CWE-330",
"CWE-338"
],
"github_reviewed": true,
"github_reviewed_at": "2022-06-01T19:50:15Z",
"nvd_published_at": "2022-05-31T17:15:00Z",
"severity": "MODERATE"
},
"details": "During an **X25519** key exchange, the client\u2019s private is generated with [**System.Random**](https://docs.microsoft.com/en-us/dotnet/api/system.random):\n\n```cs\nvar rnd = new Random();\n_privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];\nrnd.NextBytes(_privateKey);\n```\n\nSource: [KeyExchangeECCurve25519.cs](https://github.com/sshnet/SSH.NET/blob/bc99ada7da3f05f50d9379f2644941d91d5bf05a/src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs#L51) \nSource commit: https://github.com/sshnet/SSH.NET/commit/b58a11c0da55da1f5bad46faad2e9b71b7cb35b3\n\n[**System.Random**](https://docs.microsoft.com/en-us/dotnet/api/system.random) is not a cryptographically secure random number generator, it must therefore not be used for cryptographic purposes.\n\n### Impact\nWhen establishing an SSH connection to a remote host, during the X25519 key exchange, the private key is generated with\na weak random number generator whose seed can be bruteforced. This allows an attacker able to eavesdrop the\ncommunications to decrypt them.\n\n### Workarounds\nTo ensure you\u0027re not affected by this vulnerability, you can disable support for `curve25519-sha256` and `curve25519-sha256@libssh.org` key exchange algorithms by invoking the following method before a connection is established:\n```cs\nprivate static void RemoveUnsecureKEX(BaseClient client)\n{\n client.ConnectionInfo.KeyExchangeAlgorithms.Remove(\"curve25519-sha256\");\n client.ConnectionInfo.KeyExchangeAlgorithms.Remove(\"curve25519-sha256@libssh.org\");\n}\n```\n\n### Thanks\n\nThis issue was initially reported by **Siemens AG, Digital Industries**, shortly followed by @yaumn-synacktiv.",
"id": "GHSA-72p8-v4hg-v45p",
"modified": "2022-06-15T18:57:58Z",
"published": "2022-06-01T19:50:15Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/sshnet/SSH.NET/security/advisories/GHSA-72p8-v4hg-v45p"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-29245"
},
{
"type": "WEB",
"url": "https://github.com/sshnet/SSH.NET/commit/03c6d60736b8f7b42e44d6989a53f9b644a091fb"
},
{
"type": "WEB",
"url": "https://github.com/sshnet/SSH.NET/commit/f1f273cf349532b9d41c1de51d3b83a9accedc88"
},
{
"type": "PACKAGE",
"url": "https://github.com/sshnet/SSH.NET"
},
{
"type": "WEB",
"url": "https://github.com/sshnet/SSH.NET/blob/bc99ada7da3f05f50d9379f2644941d91d5bf05a/src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs#L51"
},
{
"type": "WEB",
"url": "https://github.com/sshnet/SSH.NET/releases/tag/2020.0.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Weak private key generation in SSH.NET"
}
GHSA-74RF-2VG8-WH2P
Vulnerability from github – Published: 2024-07-01 15:32 – Updated: 2024-07-01 15:32Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space.
{
"affected": [],
"aliases": [
"CVE-2024-21460"
],
"database_specific": {
"cwe_ids": [
"CWE-330"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-01T15:15:14Z",
"severity": "HIGH"
},
"details": "Information disclosure when ASLR relocates the IMEM and Secure DDR portions as one chunk in virtual address space.",
"id": "GHSA-74rf-2vg8-wh2p",
"modified": "2024-07-01T15:32:42Z",
"published": "2024-07-01T15:32:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-21460"
},
{
"type": "WEB",
"url": "https://docs.qualcomm.com/product/publicresources/securitybulletin/july-2024-bulletin.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-768M-5W34-2XF5
Vulnerability from github – Published: 2022-07-15 20:55 – Updated: 2022-07-25 19:25Impact
The function used to generate random nonces was not sufficiently cryptographically complex. As a result values may be predictable and tokens may be forgable.
Patches
Users should upgrade to version 5.0 immediately
Workarounds
None.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "packbackbooks/lti-1-3-php-library"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31157"
],
"database_specific": {
"cwe_ids": [
"CWE-327",
"CWE-330"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-15T20:55:46Z",
"nvd_published_at": "2022-07-15T18:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThe function used to generate random nonces was not sufficiently cryptographically complex. As a result values may be predictable and tokens may be forgable.\n\n### Patches\n\nUsers should upgrade to version 5.0 immediately\n\n### Workarounds\n\nNone.\n\n",
"id": "GHSA-768m-5w34-2xf5",
"modified": "2022-07-25T19:25:08Z",
"published": "2022-07-15T20:55:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31157"
},
{
"type": "WEB",
"url": "https://github.com/packbackbooks/lti-1-3-php-library/commit/de19e8a0b28cdc7750fa3ca98471eeed26ba3e57"
},
{
"type": "PACKAGE",
"url": "https://github.com/packbackbooks/lti-1-3-php-library"
},
{
"type": "WEB",
"url": "https://openid.net/specs/openid-connect-core-1_0.html#IDToken"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "LTI 1.3 Tool Library\u0027s function used to generate random nonces not sufficiently cryptographically complex before v5.0"
}
GHSA-76PH-2HXX-GXWJ
Vulnerability from github – Published: 2022-05-13 01:07 – Updated: 2025-04-12 12:50Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.
{
"affected": [],
"aliases": [
"CVE-2015-3963"
],
"database_specific": {
"cwe_ids": [
"CWE-330"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2015-08-04T01:59:00Z",
"severity": "MODERATE"
},
"details": "Wind River VxWorks before 5.5.1, 6.5.x through 6.7.x before 6.7.1.1, 6.8.x before 6.8.3, 6.9.x before 6.9.4.4, and 7.x before 7 ipnet_coreip 1.2.2.0, as used on Schneider Electric SAGE RTU devices before J2 and other devices, does not properly generate TCP initial sequence number (ISN) values, which makes it easier for remote attackers to spoof TCP sessions by predicting an ISN value.",
"id": "GHSA-76ph-2hxx-gxwj",
"modified": "2025-04-12T12:50:29Z",
"published": "2022-05-13T01:07:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3963"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01"
},
{
"type": "WEB",
"url": "https://ics-cert.us-cert.gov/advisories/ICSA-15-169-01A"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20160324-0001"
},
{
"type": "WEB",
"url": "http://www.schneider-electric.com/ww/en/download/document/SEVD-2015-162-01"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/75302"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1032730"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1033181"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-7FHM-GX9F-8C93
Vulnerability from github – Published: 2024-04-30 09:30 – Updated: 2024-04-30 09:30The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification, and if both the "Login the user automatically after the account is verified" and "Verify account for current users" options are checked, then it potentially makes it possible for attackers to bypass authentication for other users.
{
"affected": [],
"aliases": [
"CVE-2024-4185"
],
"database_specific": {
"cwe_ids": [
"CWE-330"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-30T09:15:07Z",
"severity": "HIGH"
},
"details": "The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Email Verification and Authentication Bypass in all versions up to, and including, 2.7.4 via the use of insufficiently random activation code. This makes it possible for unauthenticated attackers to bypass the email verification, and if both the \"Login the user automatically after the account is verified\" and \"Verify account for current users\" options are checked, then it potentially makes it possible for attackers to bypass authentication for other users.",
"id": "GHSA-7fhm-gx9f-8c93",
"modified": "2024-04-30T09:30:46Z",
"published": "2024-04-30T09:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-4185"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.7.4/includes/alg-wc-ev-functions.php#L299"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/emails-verification-for-woocommerce/tags/2.7.4/includes/class-alg-wc-ev-core.php#L731"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3078804/emails-verification-for-woocommerce#file2"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ebae4b18-5b5f-45c3-86e2-02eefd7abdb7?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-7QVR-F99M-RPCH
Vulnerability from github – Published: 2022-05-24 16:48 – Updated: 2024-04-04 01:00The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token's total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using 'doAirdrop' ignores the hard cap written in the contract and devalues the token.)
{
"affected": [],
"aliases": [
"CVE-2018-18425"
],
"database_specific": {
"cwe_ids": [
"CWE-330"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-06-19T16:15:00Z",
"severity": "MODERATE"
},
"details": "The doAirdrop function of a smart contract implementation for Primeo (PEO), an Ethereum token, does not check the numerical relationship between the amount of the air drop and the token\u0027s total supply, which lets the owner of the contract issue an arbitrary amount of currency. (Increasing the total supply by using \u0027doAirdrop\u0027 ignores the hard cap written in the contract and devalues the token.)",
"id": "GHSA-7qvr-f99m-rpch",
"modified": "2024-04-04T01:00:33Z",
"published": "2022-05-24T16:48:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18425"
},
{
"type": "WEB",
"url": "https://etherscan.io/address/0x21a8a03b34e053f9b1d4545213d9d1d411a9d449#code"
},
{
"type": "WEB",
"url": "https://www.jianshu.com/p/09f238e9e568"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7RG4-266C-JQW6
Vulnerability from github – Published: 2021-06-08 20:12 – Updated: 2022-06-29 20:41An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "centreon/centreon"
},
"ranges": [
{
"events": [
{
"introduced": "20.10.0"
},
{
"fixed": "20.10.7"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "centreon/centreon"
},
"ranges": [
{
"events": [
{
"introduced": "20.04.0"
},
{
"fixed": "20.04.13"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "centreon/centreon"
},
"ranges": [
{
"events": [
{
"introduced": "19.10.0"
},
{
"fixed": "19.10.23"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "centreon/centreon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.8.37"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-28055"
],
"database_specific": {
"cwe_ids": [
"CWE-330",
"CWE-352"
],
"github_reviewed": true,
"github_reviewed_at": "2021-05-07T15:18:01Z",
"nvd_published_at": "2021-04-15T19:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Centreon-Web in Centreon Platform 20.10.0. The anti-CSRF token generation is predictable, which might allow CSRF attacks that add an admin user.",
"id": "GHSA-7rg4-266c-jqw6",
"modified": "2022-06-29T20:41:29Z",
"published": "2021-06-08T20:12:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28055"
},
{
"type": "WEB",
"url": "https://github.com/centreon/centreon/pull/9612"
},
{
"type": "WEB",
"url": "https://github.com/centreon/centreon/commit/0261d4b250135eb513fdb7d52ba6fdeb19c6863f"
},
{
"type": "WEB",
"url": "https://github.com/centreon/centreon/commit/626d3fb91cef402df0ebda5a8165d8f45da67c7a"
},
{
"type": "PACKAGE",
"url": "https://github.com/centreon/centreon"
},
{
"type": "WEB",
"url": "https://github.com/centreon/centreon/releases/tag/19.10.23"
},
{
"type": "WEB",
"url": "https://github.com/centreon/centreon/releases/tag/2.8.37"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Predictable CSRF tokens in centreon/centreon"
}
GHSA-7RR3-3WCQ-VXFF
Vulnerability from github – Published: 2023-10-10 18:31 – Updated: 2024-04-04 08:29In PicoTCP 1.7.0, TCP ISNs are improperly random.
{
"affected": [],
"aliases": [
"CVE-2020-27635"
],
"database_specific": {
"cwe_ids": [
"CWE-330"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-10-10T17:15:10Z",
"severity": "CRITICAL"
},
"details": "In PicoTCP 1.7.0, TCP ISNs are improperly random.",
"id": "GHSA-7rr3-3wcq-vxff",
"modified": "2024-04-04T08:29:46Z",
"published": "2023-10-10T18:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-27635"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-21-042-01"
},
{
"type": "WEB",
"url": "https://www.forescout.com"
},
{
"type": "WEB",
"url": "https://www.forescout.com/resources/numberjack-weak-isn-generation-in-embedded-tcpip-stacks"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-7X3Q-VM79-8FCC
Vulnerability from github – Published: 2022-05-02 03:13 – Updated: 2024-02-14 18:30The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.
{
"affected": [],
"aliases": [
"CVE-2009-0255"
],
"database_specific": {
"cwe_ids": [
"CWE-330"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2009-01-22T23:30:00Z",
"severity": "MODERATE"
},
"details": "The System extension Install tool in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 creates the encryption key with an insufficiently random seed, which makes it easier for attackers to crack the key.",
"id": "GHSA-7x3q-vm79-8fcc",
"modified": "2024-02-14T18:30:24Z",
"published": "2022-05-02T03:13:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2009-0255"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/48132"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33617"
},
{
"type": "WEB",
"url": "http://secunia.com/advisories/33679"
},
{
"type": "WEB",
"url": "http://typo3.org/teams/security/security-bulletins/typo3-sa-2009-001"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2009/dsa-1711"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/33376"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-84C3-J8R2-MCM8
Vulnerability from github – Published: 2024-02-26 20:10 – Updated: 2024-02-26 20:10Problem
User sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key 535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe. This exposes users to potential loss of funds on ledgers and unauthorized access to canisters they control.
Solution
Using version >1.0.1 of @dfinity/auth-client and @dfinity/identity packages, or @nfid/embed >0.10.1-alpha.6 includes patched versions of the issue.
User sessions will be automatically fixed when they re-authenticate.
Why this happened
The DFINITY auth client library provides a function, Ed25519KeyIdentity.generate, for generating an Ed25519 key pair. This function includes an optional parameter to supply a 32-byte seed value, which will be utilized as the secret key. In cases where no seed value is provided, the library is expected to generate the secret key using secure randomness. However, a recent update of DFINITY libraries has compromised this assurance by employing an insecure seed for key pair generation.
References
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "@nfid/embed"
},
"ranges": [
{
"events": [
{
"introduced": "0.10.0"
},
{
"fixed": "0.10.1-alpha.6"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-321",
"CWE-330"
],
"github_reviewed": true,
"github_reviewed_at": "2024-02-26T20:10:10Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Problem\nUser sessions in the @nfid/embed SDK with Ed25519 keys are vulnerable due to a compromised private key `535yc-uxytb-gfk7h-tny7p-vjkoe-i4krp-3qmcl-uqfgr-cpgej-yqtjq-rqe`. This exposes users to potential loss of funds on ledgers and unauthorized access to canisters they control.\n\n### Solution\nUsing version \u003e1.0.1 of @dfinity/auth-client and @dfinity/identity packages, or @nfid/embed \u003e0.10.1-alpha.6 includes patched versions of the issue.\n\nUser sessions will be automatically fixed when they re-authenticate.\n\n### Why this happened\nThe DFINITY auth client library provides a function, `Ed25519KeyIdentity.generate`, for generating an Ed25519 key pair. This function includes an optional parameter to supply a 32-byte seed value, which will be utilized as the secret key. In cases where no seed value is provided, the library is expected to generate the secret key using secure randomness. However, a recent update of DFINITY libraries has compromised this assurance by employing an insecure seed for key pair generation.\n\n### References\n[AgentJS CVE ](https://github.com/dfinity/agent-js/security/advisories/GHSA-c9vv-fhgv-cjc3)\n",
"id": "GHSA-84c3-j8r2-mcm8",
"modified": "2024-02-26T20:10:10Z",
"published": "2024-02-26T20:10:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dfinity/agent-js/security/advisories/GHSA-c9vv-fhgv-cjc3"
},
{
"type": "WEB",
"url": "https://github.com/internet-identity-labs/sdk-ts/security/advisories/GHSA-84c3-j8r2-mcm8"
},
{
"type": "PACKAGE",
"url": "https://github.com/internet-identity-labs/sdk-ts"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys"
}
Mitigation
- Use a well-vetted algorithm that is currently considered to be strong by experts in the field, and select well-tested implementations with adequate length seeds.
- In general, if a pseudo-random number generator is not advertised as being cryptographically secure, then it is probably a statistical PRNG and should not be used in security-sensitive contexts.
- Pseudo-random number generators can produce predictable numbers if the generator is known and the seed can be guessed. A 256-bit seed is a good starting point for producing a "random enough" number.
Mitigation
Consider a PRNG that re-seeds itself as needed from high quality pseudo-random output sources, such as hardware devices.
Mitigation MIT-2
Strategy: Libraries or Frameworks
Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
CAPEC-112: Brute Force
In this attack, some asset (information, functionality, identity, etc.) is protected by a finite secret value. The attacker attempts to gain access to this asset by using trial-and-error to exhaustively explore all the possible secret values in the hope of finding the secret (or a value that is functionally equivalent) that will unlock the asset.
CAPEC-485: Signature Spoofing by Key Recreation
An attacker obtains an authoritative or reputable signer's private signature key by exploiting a cryptographic weakness in the signature algorithm or pseudorandom number generation and then uses this key to forge signatures from the original signer to mislead a victim into performing actions that benefit the attacker.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.