PT-2020-6333 · Eclipse · Eclipse Tinydtls

Published 2020-11-13 · Updated 2021-07-12 · CVE-2021-34430

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Eclipse TinyDTLS versions through 0.9-rc1

Description The issue is related to errors in the pseudorandom number generator code. This makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic, potentially allowing them to reveal protected information.

Recommendations For Eclipse TinyDTLS versions through 0.9-rc1, consider updating to a version that does not rely on the rand function in the C library for pseudorandom number generation, as this would mitigate the risk of master key computation and DTLS traffic decryption by remote attackers. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Inadequate Encryption Strength

Weakness Enumeration

CWE-326

CWE-338

Related Identifiers

BDU:2021-04207

CVE-2021-34430

Affected Products

Eclipse Tinydtls

References · 5

• 🔥 https://bugs.eclipse.org/bugs/show_bug.cgi?id=568803 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-34430 · Security Note
• https://bdu.fstec.ru/vul/2021-04207 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34430 · Vendor Advisory
• https://t.me/cibsecurity/25994 · Telegram Post