{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "datePublic": "2012-09-19T00:00:00", "descriptions": [{"lang": "en", "value": "Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, uses predictable random numbers to generate session keys, which makes it easier for remote attackers to guess the session key."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2017-08-28T12:57:01", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat"}, "references": [{"tags": ["x_refsource_MISC"], "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=827558"}, {"name": "55618", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/55618"}, {"name": "cumin-redhat-weak-security(78771)", "tags": ["vdb-entry", "x_refsource_XF"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78771"}, {"name": "RHSA-2012:1278", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1278.html"}, {"name": "RHSA-2012:1281", "tags": ["vendor-advisory", "x_refsource_REDHAT"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1281.html"}, {"name": "50660", "tags": ["third-party-advisory", "x_refsource_SECUNIA"], "url": "http://secunia.com/advisories/50660"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T19:42:31.976Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=827558"}, {"name": "55618", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/55618"}, {"name": "cumin-redhat-weak-security(78771)", "tags": ["vdb-entry", "x_refsource_XF", "x_transferred"], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78771"}, {"name": "RHSA-2012:1278", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1278.html"}, {"name": "RHSA-2012:1281", "tags": ["vendor-advisory", "x_refsource_REDHAT", "x_transferred"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1281.html"}, {"name": "50660", "tags": ["third-party-advisory", "x_refsource_SECUNIA", "x_transferred"], "url": "http://secunia.com/advisories/50660"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2012-2681", "datePublished": "2012-09-28T17:00:00", "dateReserved": "2012-05-14T00:00:00", "dateUpdated": "2024-08-06T19:42:31.976Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:trevor_mckay:cumin:*:*:*:*:*:*:*:*", "matchCriteriaId": "EB8CE3E6-C78F-4363-B731-A7981046EE5B", "versionEndIncluding": "0.1.5192-4", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.3160-1:*:*:*:*:*:*:*", "matchCriteriaId": "B33C6617-24FB-4C96-A786-D26B074B0569", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4369-1:*:*:*:*:*:*:*", "matchCriteriaId": "D6CF3F68-713E-48E8-8D37-4AE443AF87FC", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4410-2:*:*:*:*:*:*:*", "matchCriteriaId": "8BDF4FB8-5ECF-4A2F-8066-8C362574B55F", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4494-1:*:*:*:*:*:*:*", "matchCriteriaId": "6ADC326A-3CE8-4710-870B-BF540CCB4A5E", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4794-1:*:*:*:*:*:*:*", "matchCriteriaId": "FFB4776E-178C-4488-9C98-98859576E343", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.4916-1:*:*:*:*:*:*:*", "matchCriteriaId": "77B6E427-B880-48EB-8139-2F54381539BB", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5098-2:*:*:*:*:*:*:*", "matchCriteriaId": "11E7AFB1-7864-47D4-AD75-9B9950BE7BBB", "vulnerable": true}, {"criteria": "cpe:2.3:a:trevor_mckay:cumin:0.1.5192-1:*:*:*:*:*:*:*", "matchCriteriaId": "CACA1231-8272-40A9-B7B3-0141E0F1D7A7", "vulnerable": true}, {"criteria": "cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:*", "matchCriteriaId": "C60FA8B1-1802-4522-A088-22171DCF7A93", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, uses predictable random numbers to generate session keys, which makes it easier for remote attackers to guess the session key."}, {"lang": "es", "value": "Cumin antes de v0.1.5444, tal y como se utiliza en Red Hat Enterprise Messaging, Realtime y Grid (MRG) v2.0, usa numeros aleatorios predecibles para generar claves de sesi\u00f3n, lo que hace m\u00e1s f\u00e1cil para los atacantes remotos a la hora de adivinar la clave de sesi\u00f3n."}], "id": "CVE-2012-2681", "lastModified": "2021-07-15T19:16:09.750", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 4.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2012-09-28T17:55:00.787", "references": [{"source": "secalert@redhat.com", "tags": ["Exploit"], "url": "http://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=827558"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1278.html"}, {"source": "secalert@redhat.com", "tags": ["Vendor Advisory"], "url": "http://rhn.redhat.com/errata/RHSA-2012-1281.html"}, {"source": "secalert@redhat.com", "url": "http://secunia.com/advisories/50660"}, {"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/55618"}, {"source": "secalert@redhat.com", "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/78771"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-310"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"acknowledgement": "This issue was discovered by Florian Weimer (Red Hat Product Security Team).", "affected_release": [{"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "condor-0:7.6.5-0.22.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "condor-wallaby-0:4.1.3-1.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "condor-wallaby-base-db-0:1.23-1.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "cumin-0:0.1.5444-3.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "sesame-0:1.0-4.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1278", "cpe": "cpe:/a:redhat:enterprise_mrg:2::el5", "package": "wallaby-0:0.12.5-10.el5", "product_name": "MRG for RHEL-5 v. 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "condor-0:7.6.5-0.22.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "condor-wallaby-0:4.1.3-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "condor-wallaby-base-db-0:1.23-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "cumin-0:0.1.5444-3.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "deltacloud-core-0:0.5.0-10.el6_2", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "libdeltacloud-0:0.9-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-daemons-0:1.1.4-2.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-eventmachine-0:0.12.10-7.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-fssm-0:0.2.7-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-haml-0:3.1.2-2.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-hpricot-0:0.8.4-2.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-json-0:1.4.6-10.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-maruku-0:0.6.0-4.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-mime-types-0:1.16-4.el6_0", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-mocha-0:0.9.7-4.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-net-ssh-0:2.0.23-6.el6_0", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-nokogiri-0:1.5.0-0.8.beta4.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-rack-1:1.3.0-2.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-rack-accept-0:0.4.3-6.el6_0", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-rack-test-0:0.6.1-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-rake-0:0.8.7-2.1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-rest-client-0:1.6.1-2.el6_0", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygems-0:1.8.16-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-sass-0:3.1.4-4.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-sinatra-1:1.2.6-2.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-syntax-0:1.0.0-4.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-thin-0:1.2.11-3.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-tilt-0:1.3.2-3.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "rubygem-yard-0:0.7.2-1.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "sesame-0:1.0-6.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}, {"advisory": "RHSA-2012:1281", "cpe": "cpe:/a:redhat:enterprise_mrg:2:server:el6", "package": "wallaby-0:0.12.5-10.el6", "product_name": "Red Hat Enterprise MRG 2", "release_date": "2012-09-19T00:00:00Z"}], "bugzilla": {"description": "cumin: weak session keys", "id": "827558", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=827558"}, "csaw": false, "cvss": {"cvss_base_score": "5.8", "cvss_scoring_vector": "AV:N/AC:M/Au:N/C:P/I:P/A:N", "status": "verified"}, "details": ["Cumin before 0.1.5444, as used in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0, uses predictable random numbers to generate session keys, which makes it easier for remote attackers to guess the session key."], "name": "CVE-2012-2681", "package_state": [{"cpe": "cpe:/a:redhat:enterprise_mrg:1", "fix_state": "Will not fix", "package_name": "cumin", "product_name": "Red Hat Enterprise MRG 1"}], "public_date": "2012-09-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2012-2681\nhttps://nvd.nist.gov/vuln/detail/CVE-2012-2681"], "threat_severity": "Moderate"}