Vulnerability Details : CVE-2016-1902
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Products affected by CVE-2016-1902
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:*:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.4:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.5:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.3:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.7:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.6:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.9:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.8:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.10:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.11:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.7.8:*:*:*:*:*:*:*
- cpe:2.3:a:sensiolabs:symfony:2.6.12:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-1902
0.17%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 53 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-1902
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2016-1902
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-1902
-
https://www.landaire.net/blog/cve-2016-1902-symfony-securerandom/
CVE-2016-1902: Symfony SecureRandom - Lander Brandt
-
http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails (Symfony Blog)Vendor Advisory
-
https://github.com/symfony/symfony/pull/17359
do not ship with a custom rng implementation by fabpot · Pull Request #17359 · symfony/symfony · GitHubPatch
-
http://www.debian.org/security/2016/dsa-3588
Debian -- Security Information -- DSA-3588-1 symfony
Jump to