CVE-2024-45751

Published: Sep 6, 2024Modified: Jun 17, 2026Deferred

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 2.2 / Impact: 3.6

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed is always 1, and thus the sequence of challenges is always identical.

Related CWEs

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

References (5)

https://github.com/fujita/tgt/compare/v1.0.92...v1.0.93

Source: cve@mitre.org

https://github.com/fujita/tgt/pull/67

Source: cve@mitre.org

https://www.openwall.com/lists/oss-security/2024/09/07/2

Source: cve@mitre.org

http://www.openwall.com/lists/oss-security/2024/09/07/2

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2024/11/msg00033.html

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.