CVE-2016-1902
published 2016-06-01CVE-2016-1902: The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random…
PriorityP339high7.5CVSS 3.0
AVNACLPRNUINSUCHINAN
EPSS
1.91%
77.4th percentile
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Affected
37 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | symfony | < symfony 2.7.9+dfsg-1 (bookworm) | symfony 2.7.9+dfsg-1 (bookworm) |
| sensiolabs | symfony | <= 2.3.36 | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
| sensiolabs | symfony | — | — |
CVSS provenance
nvdv3.07.5HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Symfony Cryptographic Vulnerability
osv·2022-05-17
CVE-2016-1902 [HIGH] Symfony Cryptographic Vulnerability
Symfony Cryptographic Vulnerability
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
GHSA
Symfony Cryptographic Vulnerability
ghsa·2022-05-17
CVE-2016-1902 [HIGH] CWE-332 Symfony Cryptographic Vulnerability
Symfony Cryptographic Vulnerability
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
OSV
CVE-2016-1902: The nextBytes function in the SecureRandom class in Symfony before 2
osv·2016-06-01·CVSS 7.5
CVE-2016-1902 [HIGH] CVE-2016-1902: The nextBytes function in the SecureRandom class in Symfony before 2
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Debian
CVE-2016-1902: symfony - The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x...
vendor_debian·2016·CVSS 7.5
CVE-2016-1902 [HIGH] CVE-2016-1902: symfony - The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x...
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
Scope: local
bookworm: resolved (fixed in 2.7.9+dfsg-1)
bullseye: resolved (fixed in 2.7.9+dfsg-1)
forky: resolved (fixed in 2.7.9+dfsg-1)
sid: resolved (fixed in 2.7.9+dfsg-1)
trixie: resolved (fixed in 2.7.9+dfsg-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2016-1902 php-symfony: SecureRandom's fallback not secure when OpenSSL fails
bugzilla·2016-05-30·CVSS 7.5
CVE-2016-1902 [HIGH] CVE-2016-1902 php-symfony: SecureRandom's fallback not secure when OpenSSL fails
CVE-2016-1902 php-symfony: SecureRandom's fallback not secure when OpenSSL fails
The SecureRandom Symfony class goal is to generate secure random numbers. Several strategies are used depending on PHP's configuration. On PHP installations where the random_bytes() function is not available, Symfony falls back to using openssl_random_pseudo_bytes(). If that does not work, Symfony generates a secure random number using uniqid() and mt_rand(), which are not suitable for cryptographic contexts.
External references:
https://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-fails
Discussion:
Created php-symfony tracking bugs for this issue:
Affects: epel-6 [bug 1340831]
---
All dependent bugs closed.
Bugzilla
CVE-2016-1902 php-symfony: SecureRandom's fallback not secure when OpenSSL fails [epel-6]
bugzilla·2016-05-30·CVSS 7.5
CVE-2016-1902 [HIGH] CVE-2016-1902 php-symfony: SecureRandom's fallback not secure when OpenSSL fails [epel-6]
CVE-2016-1902 php-symfony: SecureRandom's fallback not secure when OpenSSL fails [epel-6]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora EPEL.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
[bug automatically created by: add-trac
http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-failshttp://www.debian.org/security/2016/dsa-3588https://github.com/symfony/symfony/pull/17359https://www.landaire.net/blog/cve-2016-1902-symfony-securerandom/http://symfony.com/blog/cve-2016-1902-securerandom-s-fallback-not-secure-when-openssl-failshttp://www.debian.org/security/2016/dsa-3588https://github.com/symfony/symfony/pull/17359https://www.landaire.net/blog/cve-2016-1902-symfony-securerandom/
2016-06-01
Published