Skip to content
fr Sign in
6.5 Medium

CVE-2024-21495 Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to…

Description

Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.

Affected products and versions

Product Affected versions Fixed in
github.com/greenpau/caddy-security 1.0 earliest → < 1.0.42 1.0.42
caddy_security 1.0 earliest → < 1.0.42 1.0.42

References

Timeline

  1. Published
  2. Last modified

Other CVEs of github.com/greenpau/caddy-security

The 9 CVEs of github.com/greenpau/caddy-security →
CVE-2024-21493 All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when… 5.3 Medium CVE-2024-21494 All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via… 5.4 Medium CVE-2024-21500 All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive… 4.8 Medium CVE-2024-21499 All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the… 4.3 Medium
Track this CVE