NVD

Id
18226  
Name
CVE-2016-1902  
Description
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-19  
Published
2016-06-01  
Modified Date
2016-06-03  
Seq
2016-1902  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
100623 18226 CVE-2016-1902 http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails  View
100624 18226 CVE-2016-1902 DSA-3588  View
100625 18226 CVE-2016-1902 https://github.com/symfony/symfony/pull/17359  View
100626 18226 CVE-2016-1902 https://www.landaire.net/blog/cve-2016-1902-symfony-securerandom/  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
2219 JVNDB-2016-002992 Symfony の SecureRandom クラスの nextBytes 関数における暗号保護メカニズムを破られる脆弱性 Symfony の SecureRandom クラスの nextBytes 関数は、paragonie/random_compat ライブラリのない PHP 5.x とともに使用される、および openssl_random_pseudo_bytes 関数が失敗する場合、乱数を適切に生成しないため、暗号保護メカニズムを破られる脆弱性が存在します。 CVE-2016-1902 88408 CVE-2016-1902 18226 5 7.5 http://jvndb.jvn.jp/ja/contents/2016/JVNDB-2016-002992.html 2016-01-18 2016-06-06 View