CVE-2018-16115

Severity Score

9.1

*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators. For historical reasons, Akka included the AES128CounterSecureRNG and AES256CounterSecureRNG random number generators. The implementations had a bug that caused the generated numbers to be repeated after only a few bytes. The custom RNG implementations were not configured by default but examples in the documentation showed (and therefore implicitly recommended) using the custom ones. This can be used by an attacker to compromise the communication if these random number generators are enabled in configuration. It would be possible to eavesdrop, replay, or modify the messages sent with Akka Remoting/Cluster.

Lightbend Akka en versiones 2.5.x anteriores a la 2.5.16 permite la revelación y modificación de mensajes debido a un error de RNG. Se emplea un generador de números aleatorios en Akka Remoting for TLS (tanto en la versión clásica como en Artery Remoting). Akka permite la configuración de generadores de números aleatorios personalizados. Por motivos históricos, Akka incluía los generadores de números aleatorios AES128CounterSecureRNG y AES256CounterSecureRNG. Las implementaciones tenían un error que provocaba que los números generados se repitiesen tras solo unos pocos bytes. Las implementaciones RGN personalizadas no estaban configuradas por defecto, pero los ejemplos de la documentación mostraban (y, por lo tanto, recomendaban implícitamente) el uso de las implementaciones personalizadas. Esto puede ser empleado por un atacante para comprometer la comunicación si estos generadores de números aleatorios están habilitados en la configuración. Sería posible escuchar, reproducir o modificar los mensajes enviados con Akka Remoting/Cluster.

*Credits: N/A

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

None

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2018-08-29 CVE Reserved
2018-08-29 CVE Published
2023-03-07 EPSS Updated
2024-08-05 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CAPEC

References (1)

URL	Tag	Source

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
https://doc.akka.io/docs/akka/current/security/2018-08-29-aes-rng.html	2018-11-08

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Lightbend Search vendor "Lightbend"		Akka Search vendor "Lightbend" for product "Akka"				>= 2.5.0 < 2.5.16 Search vendor "Lightbend" for product "Akka" and version " >= 2.5.0 < 2.5.16"		-		Affected