PT-2024-40424 · Stormpath · Stormpath-Sdk-Php

Published 2024-05-29 · Updated 2024-05-29

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions stormpath-sdk-php (affected versions not specified)

Description The issue is related to the use of an insecure random number generator (RNG) in the generation of UUID version 4 within the codebase.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-338

Related Identifiers

GHSA-Q8FC-V85F-78PW

Affected Products

Stormpath-Sdk-Php

References · 6

• https://osv.dev/vulnerability/GHSA-q8fc-v85f-78pw · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/stormpath/sdk/2017-11-20.yaml · Note
• https://github.com/stormpath/stormpath-sdk-php/issues/132 · Note
• https://github.com/stormpath/stormpath-sdk-php · Note
• https://github.com/stormpath/stormpath-sdk-php/blob/15aee3007b8aa41c20cdf28fd650b8a2368a7fa9/src/Util/UUID.php#L167-L181 · Note
• https://github.com/stormpath/stormpath-sdk-php/blob/62698ea98ef89217f932e28cf3e511d39af3b4cf/src/Authc/Api/ApiKeyEncryptionOptions.php#L48-L50 · Note