CVE-2018-1000620 is a critical insufficient entropy vulnerability (CWE-331) in the randomDigits() method of Eran Hammer's cryptiles library, versions 4.1.1 and earlier. This flaw allows attackers to more easily brute force values intended to be random, potentially leading to full compromise of confidentiality, integrity, and availability. With a CVSS score of 9.8 (CRITICAL), it is easily exploitable over the network with low attack complexity. While there is no known active exploitation, public exploit code, or Metasploit/Nuclei modules, the vulnerability has garnered significant community discussion, indicating awareness and potential future interest. The issue was resolved in cryptiles version 4.1.2.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 3.1.3CPE matchmatch criteria | cpe:2.3:a:cryptiles_project:cryptiles:*:*:*:*:*:*:*:* | ||
>= 4.1.0, < 4.1.2CPE matchmatch criteria | cpe:2.3:a:cryptiles_project:cryptiles:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.