CVSS: 9.1EPSS: 0%CPEs: 1EXPL: 0CVE-2018-16115
https://notcve.org/view.php?id=CVE-2018-16115
Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators. For historical reasons, Akka included the AES128CounterSecureRNG and AES256CounterSecureRNG random number generators. The implementations had a bug that caused the generated numbers to be repeated after only a few bytes. • https://doc.akka.io/docs/akka/current/security/2018-08-29-aes-rng.html • CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) •
CVSS: 9.3EPSS: 4%CPEs: 2EXPL: 0CVE-2017-1000034
https://notcve.org/view.php?id=CVE-2017-1000034
Akka versions <=2.4.16 and 2.5-M1 are vulnerable to a java deserialization attack in its Remoting component resulting in remote code execution in the context of the ActorSystem. En Akka versiones anteriores e incluyendo a 2.4.16 y 2.5-M1, son vulnerables a un ataque de deserialización java en el componente Remoting, resultando en la ejecución de código remota en el contexto del ActorSystem. • http://doc.akka.io/docs/akka/2.4/security/2017-02-10-java-serialization.html • CWE-502: Deserialization of Untrusted Data •