PT-2022-24981 · Drogon · Drogon

Itrofimow · Published 2022-11-11 · Updated 2022-11-16 · CVE-2022-3959

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions drogon versions up to 1.8.1

Description A problematic issue has been found in the Session Hash Handler component, allowing for remote attacks that lead to a small space of random values. The estimated number of potentially affected devices is not specified.

Recommendations For drogon versions up to 1.8.1, upgrade to version 1.8.2 to address this issue.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-330

Related Identifiers

CVE-2022-3959

Affected Products

Drogon

References · 6

• https://github.com/drogonframework/drogon/commit/c0d48da99f66aaada17bcd28b07741cac8697647 · Patch
• https://github.com/drogonframework/drogon/pull/1433 · Patch
• https://osv.dev/vulnerability/CVE-2022-3959 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-3959 · Security Note
• https://github.com/drogonframework/drogon/releases/tag/v1.8.2 · Note
• https://vuldb.com/?id.213464 · Note