CVE Vulnerabilities

CVE-2022-33738

Insufficient Entropy

Published: Jul 06, 2022 | Modified: Nov 21, 2024
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:P/I:N/A:N
RedHat/V2
RedHat/V3
Ubuntu

OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal

Weakness

The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.

Affected Software

Name Vendor Start Version End Version
Openvpn_access_server Openvpn * 2.11.0 (excluding)

Potential Mitigations

References