CVE Vulnerabilities

CVE-2024-57835

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Published: Apr 05, 2025 | Modified: Apr 08, 2025
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
Ubuntu

Amon2::Auth::Site::LINE uses the String::Random module to generate nonce values. 

String::Random defaults to Perls built-in predictable random number generator, the rand() function, which is not cryptographically secure

Weakness 

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG’s algorithm is not cryptographically strong.

Affected Software 

Name Vendor Start Version End Version
Line_integration_for_amon2 Nipotan * 0.04 (excluding)

Extended Description 

When a non-cryptographic PRNG is used in a cryptographic context, it can expose the cryptography to certain types of attacks. Often a pseudo-random number generator (PRNG) is not designed for cryptography. Sometimes a mediocre source of randomness is sufficient or preferable for algorithms that use random numbers. Weak generators generally take less processing power and/or do not use the precious, finite, entropy sources on a system. While such PRNGs might have very useful features, these same features could be used to break the cryptography.

Potential Mitigations 

References