6.5
Moyenne
CVE-2024-21495 Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to…
Description
Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure random number generation library which could possibly be predicted via a brute-force search. Attackers could use the potentially predictable nonce value used for authentication purposes in the OAuth flow to conduct OAuth replay attacks. In addition, insecure randomness is used while generating multifactor authentication (MFA) secrets and creating API keys in the database package.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| github.com/greenpau/caddy-security 1.0 | premières → < 1.0.42 | 1.0.42 |
| caddy_security 1.0 | premières → < 1.0.42 | 1.0.42 |
Références
- security.snyk.io security.snyk.io
- github.com github.com
- blog.trailofbits.com blog.trailofbits.com
- github.com github.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de github.com/greenpau/caddy-security
Les 9 CVE de github.com/greenpau/caddy-security →
CVE-2024-21493
All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when…
5.3
Moyenne
CVE-2024-21494
All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via…
5.4
Moyenne
CVE-2024-21500
All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive…
4.8
Moyenne
CVE-2024-21499
All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the…
4.3
Moyenne