PT-2024-10687 · Unknown · Rsakeypairgenerator

Published 2024-12-02 · Updated 2024-12-18 · CVE-2018-9426

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions RSAKeyPairGenerator (affected versions not specified)

Description An incorrect implementation in RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java could cause the generation of weak RSA key pairs. This could lead to a crypto vulnerability with no additional execution privileges needed. User interaction is not needed for exploitation. The fix is designed to correctly implement the key generation according to the FIPS standard.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-331

Related Identifiers

CVE-2018-9426

Affected Products

Rsakeypairgenerator

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-9426 · Security Note
• https://source.android.com/docs/security/bulletin/pixel/2018-07-01 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-9426 · Vendor Advisory
• https://t.me/cvedetector/11842 · Telegram Post
• https://t.me/cvenotify/102894 · Telegram Post