CVE-2007-5502

The PRNG implementation for the OpenSSL FIPS Object Module 1.1.1 does not perform auto-seeding during the FIPS self-test, which generates random data that is more predictable than expected and makes it easier for attackers to bypass protection mechanisms that rely on the randomness.

Score

CVSS 2.0 6.4 Medium

Status

Modified - secalert@redhat.com

Published

2007-12-01

Last modified

2024-08-07

Weaknesses

CWE-310

Affected products

• Fips Object Module (Openssl)

References

• http://secunia.com/advisories/27859
• http://www.kb.cert.org/vuls/id/150249
• http://www.openssl.org/news/secadv_20071129.txt
• http://www.securityfocus.com/bid/26652
• http://www.securitytracker.com/id?1019029
• http://www.vupen.com/english/advisories/2007/4044
• https://exchange.xforce.ibmcloud.com/vulnerabilities/38796