PT-2018-13412 · Lightbend · Akka

Rafaå Sumisåawski · Publicado 2018-08-29 · Atualizado 2018-11-08 · CVE-2018-16115

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Lightbend Akka versions 2.5.x through 2.5.15

Description The issue allows message disclosure and modification due to an RNG error in Akka Remoting for TLS. A random number generator is used, and Akka permits configuration of custom random number generators. The custom RNG implementations, AES128CounterSecureRNG and AES256CounterSecureRNG, had a bug causing repeated generated numbers after a few bytes. Although not configured by default, examples in the documentation implicitly recommended using these custom implementations. This could enable an attacker to compromise communication if these random number generators are enabled, allowing eavesdropping, replaying, or modifying messages sent with Akka Remoting/Cluster.

Recommendations For Lightbend Akka versions 2.5.x through 2.5.15, update to version 2.5.16 or later to resolve the issue. As a temporary workaround, consider disabling the custom random number generators AES128CounterSecureRNG and AES256CounterSecureRNG until a patch is available. Restrict access to Akka Remoting/Cluster to minimize the risk of exploitation. Avoid using the custom RNG implementations in the configuration until the issue is resolved.

Correção

Enumeração de Fraquezas

CWE-338

Identificadores relacionados

CVE-2018-16115

GHSA-MR95-9RR4-668F

Produtos afetados

Akka

Referências · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-16115 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-mr95-9rr4-668f · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-16115 · Aviso do Fabricante
• https://doc.akka.io/docs/akka/current/security/2018-08-29-aes-rng.html · Aviso do Fabricante
• https://github.com/advisories/GHSA-mr95-9rr4-668f · Nota