PT-2022-19374 · Jetbrains · Jetbrains Ktor Native

Dan Wallach · Published 2022-04-11 · Updated 2022-04-15 · CVE-2022-29035

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions JetBrains Ktor Native versions prior to 2.0.0

Description The issue concerns the generation of random values for nonces in JetBrains Ktor Native, where these values were not generated using SecureRandom implementations.

Recommendations For versions prior to 2.0.0, update to version 2.0.0 or later to resolve the issue.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2022-29035

Affected Products

Jetbrains Ktor Native

References · 5

• https://github.com/ktorio/ktor/pull/2776 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2022-29035 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29035 · Vendor Advisory
• https://jetbrains.com/privacy-security/issues-fixed · Patch
• https://t.me/cibsecurity/40499 · Telegram Post