CVE-2022-30295 — Use of Insufficiently Random Values in Project Uclibc-ng

CWE-330 — Use of Insufficiently Random Values5 documents5 sources
Severity
6.5MEDIUMNVD
EPSS
0.3%
top 44.00%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Uclibc-ng Project Uclibc-ngUclibcDebian Uclibc+2 more
Timeline
PublishedMay 6
Latest updateMay 10

Description

uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:NExploitability: 2.2 | Impact: 4.2

Affected Packages5 packages

▶NVDuclibc/uclibc0.9.33.2
▶debiandebian/uclibc

🔴Vulnerability Details

2
GHSA
GHSA-gv7v-mf7r-p93f: uClibc-ng through 1↗2022-05-07
▶
OSV
CVE-2022-30295: uClibc-ng through 1↗2022-05-06
▶

📋Vendor Advisories

2
Microsoft
uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. This is related to a reset of a value to 0x2.↗2022-05-10
▶
Debian
CVE-2022-30295: uclibc - uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transac...↗2022
▶