{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2018-1000620", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateReserved": "2018-07-09T00:00:00Z", "dateUpdated": "2024-09-16T18:45:19.030Z", "datePublished": "2018-07-09T20:00:00Z"}, "containers": {"cna": {"dateAssigned": "2018-07-08T00:00:00", "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-03-31T00:00:00"}, "descriptions": [{"lang": "en", "value": "Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/hapijs/cryptiles/issues/34"}, {"url": "https://github.com/hapijs/cryptiles/issues/35"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}], "datePublic": "2018-06-24T00:00:00"}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T12:40:47.561Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/hapijs/cryptiles/issues/34", "tags": ["x_transferred"]}, {"url": "https://github.com/hapijs/cryptiles/issues/35", "tags": ["x_transferred"]}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:cryptiles_project:cryptiles:*:*:*:*:*:*:*:*", "matchCriteriaId": "EE6FEFB7-2721-4CBD-A604-51B47DCBA338", "versionEndExcluding": "3.1.3", "vulnerable": true}, {"criteria": "cpe:2.3:a:cryptiles_project:cryptiles:*:*:*:*:*:*:*:*", "matchCriteriaId": "F53B05E2-7458-4763-A1C8-4A7B69CCFB09", "versionEndExcluding": "4.1.2", "versionStartIncluding": "4.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2."}, {"lang": "es", "value": "cryptiles, de Eran Hammer, en versiones 4.1.1 y anteriores contiene una vulnerabilidad CWE-331: entrop\u00eda insuficiente en el m\u00e9todo randomDigits() que puede resultar en que un atacante pueda forzar algo que deber\u00eda ser aleatorio. Este ataque parece ser explotable mediante la aplicaci\u00f3n que llama. La vulnerabilidad parece haber sido solucionada en la versi\u00f3n 4.1.2."}], "id": "CVE-2018-1000620", "lastModified": "2023-03-31T20:15:07.097", "metrics": {"cvssMetricV2": [{"acInsufInfo": true, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2018-07-09T20:29:00.737", "references": [{"source": "cve@mitre.org", "tags": ["Issue Tracking", "Patch", "Third Party Advisory"], "url": "https://github.com/hapijs/cryptiles/issues/34"}, {"source": "cve@mitre.org", "url": "https://github.com/hapijs/cryptiles/issues/35"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-331"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "nodejs-cryptiles: Insecure randomness causes the randomDigits() function returns a pseudo-random data string biased to certain digits", "id": "1608153", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1608153"}, "csaw": false, "cvss3": {"cvss3_base_score": "3.7", "cvss3_scoring_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-330", "details": ["Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.", "A flaw was found in the nodejs-cryptiles library prior to version 4.1.2. Previous versions do not implement cryptographically secure randomness resulting in the randomDigits() function returning a pseudo-random data string biased to certain digits. An attacker could exploit this to guess the generated digits."], "name": "CVE-2018-1000620", "package_state": [{"cpe": "cpe:/a:redhat:mobile_application_platform:4", "fix_state": "Not affected", "package_name": "nodejs-cryptiles", "product_name": "Red Hat Mobile Application Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:3", "fix_state": "Not affected", "package_name": "nodejs-cryptiles", "product_name": "Red Hat OpenShift Enterprise 3"}, {"cpe": "cpe:/a:redhat:quay:3", "fix_state": "Will not fix", "impact": "low", "package_name": "quay/quay-rhel8", "product_name": "Red Hat Quay 3"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "package_name": "rh-nodejs6-nodejs-cryptiles", "product_name": "Red Hat Software Collections"}, {"cpe": "cpe:/a:redhat:rhel_software_collections:3", "fix_state": "Not affected", "package_name": "rh-nodejs8-nodejs", "product_name": "Red Hat Software Collections"}], "public_date": "2018-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2018-1000620\nhttps://nvd.nist.gov/vuln/detail/CVE-2018-1000620"], "statement": "Red Hat Quay imports nodejs-crypttiles as a development dependency. Reducing the impact of Red Hat Quay to low.", "threat_severity": "Moderate", "upstream_fix": "nodejs-cryptiles 4.1.2"}