CVE-2015-8867
php: openssl_random_pseudo_bytes() is not cryptographically secure
Severity Score
7.5
*CVSS v3
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
The openssl_random_pseudo_bytes function in ext/openssl/openssl.c in PHP before 5.4.44, 5.5.x before 5.5.28, and 5.6.x before 5.6.12 incorrectly relies on the deprecated RAND_pseudo_bytes function, which makes it easier for remote attackers to defeat cryptographic protection mechanisms via unspecified vectors.
La función openssl_random_pseudo_bytes en ext/openssl/openssl.c en PHP en versiones anteriores a 5.4.44, 5.5.x en versiones anteriores a 5.5.28 y 5.6.x en versiones anteriores a 5.6.12 se basa incorrectamente en la función en desuso RAND_pseudo_bytes, lo que hace que sea más fácil para los atacantes remotos vencer a los mecanismos de protección de cifrado a través de vectores no especificados.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2016-04-23 CVE Reserved
- 2016-05-22 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-310: Cryptographic Issues
CAPEC
References (14)
| URL | Tag | Source |
|---|---|---|
| http://git.php.net/?p=php-src.git%3Ba=commit%3Bh=16023f3e3b9c06cf677c3c980e8d574e4c162827 | X_refsource_confirm | |
| http://www.openwall.com/lists/oss-security/2016/04/24/1 | Mailing List |
|
| https://bugs.launchpad.net/ubuntu/+source/php5/+bug/1534203 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00031.html | 2023-11-07 | |
| http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00033.html | 2023-11-07 | |
| http://lists.opensuse.org/opensuse-security-announce/2016-05/msg00056.html | 2023-11-07 | |
| http://rhn.redhat.com/errata/RHSA-2016-2750.html | 2023-11-07 | |
| http://www.php.net/ChangeLog-5.php | 2023-11-07 | |
| http://www.php.net/ChangeLog-7.php | 2023-11-07 | |
| http://www.ubuntu.com/usn/USN-2952-1 | 2023-11-07 | |
| http://www.ubuntu.com/usn/USN-2952-2 | 2023-11-07 | |
| https://bugs.php.net/bug.php?id=70014 | 2023-11-07 | |
| https://access.redhat.com/security/cve/CVE-2015-8867 | 2016-11-15 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1330420 | 2016-11-15 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | >= 5.4.0 < 5.4.44 Search vendor "Php" for product "Php" and version " >= 5.4.0 < 5.4.44" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | >= 5.5.0 < 5.5.28 Search vendor "Php" for product "Php" and version " >= 5.5.0 < 5.5.28" | - |
Affected
| ||||||
| Php Search vendor "Php" | Php Search vendor "Php" for product "Php" | >= 5.6.0 < 5.6.12 Search vendor "Php" for product "Php" and version " >= 5.6.0 < 5.6.12" | - |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04" | lts |
Affected
| ||||||
| Canonical Search vendor "Canonical" | Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux" | 15.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "15.10" | - |
Affected
| ||||||