Fallos del tipo CWE-331

101 resultados

Entropia Insuficiente

A geração de números aleatórios ou valores criptográficos usa fonte de aleatoriedade fraca (como timestamp, PID ou função pseudoaleatória simples), permitindo que um atacante preveja ou reproduza os valores gerados. Isso compromete a segurança de tokens, chaves, nonces e IDs que deveriam ser imprevisíveis.

Ejemplo

Um sistema gera tokens de sessão usando apenas Math.random() ou concatenando a hora atual com um número sequencial. Um atacante consegue adivinhar tokens válidos de outros usuários porque a origem de aleatoriedade é reproduzível ou tem espaço de busca pequeno.

Cómo mitigar

Use geradores criptográficos recomendados pelo sistema operacional: os.urandom() (Python), crypto.getRandomBytes() (Node.js), SecureRandom (Java) ou /dev/urandom (Linux). Nunca use Math.random(), rand() ou funções baseadas em clock/PID para segurança.

CVE-2023-36610MEDIUM ​The affected TBox RTUs generate software security tokens using insufficient entropy. The random seed used to generate the software tokens EPSS 0.5%CVE-2026-62646CRITICALA vulnerability has been identified in Reyrolle 7SR5 (All versions < V2.70). A session identifier is generated using an algorithm with insufEPSS 0.5%CVE-2026-19906MEDIUMpkp pkp-lib API Key Generation APIProfileForm.php setData entropyEPSS 0.5%CVE-2026-19748MEDIUMTenda CH7 Kylin Web Service CWebSessionManager_ParseSession entropyEPSS 0.5%CVE-2023-34973LOWQTS, QuTS heroEPSS 0.5%CVE-2025-66565CRITICALFiber Utils UUIDv4 and UUID Silent Fallback to Predictable ValuesEPSS 0.5%CVE-2017-2626MEDIUMIt was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys. A local attacker could potentially use this flaw for sessEPSS 0.5%CVE-2026-27490HIGHCombodo iTop: Weak secret generation for inline imageEPSS 0.4%CVE-2026-46473HIGHAuthen::TOTP versions before 0.1.1 for Perl generate secrets using randEPSS 0.4%CVE-2025-54885MEDIUMThinbus generates insufficient entropy: 252 bits vs minimum 256 bitsEPSS 0.4%CVE-2025-1828HIGHPerl's Crypt::Random module after 1.05 and before 1.56 may use rand() function for cryptographic functionsEPSS 0.4%CVE-2021-3505—A flaw was found in libtpms in versions before 0.8.0. The TPM 2 implementation returns 2048 bit keys with ~1984 bit strength due to a bug inEPSS 0.4%CVE-2026-41080LOWlibexpat before 2.8.0 uses insufficient entropy, and thus hash flooding can occur via a crafted XML document.EPSS 0.4%CVE-2024-22473MEDIUMUninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devicesEPSS 0.4%CVE-2022-34746MEDIUMAn insufficient entropy vulnerability caused by the improper use of randomness sources with low entropy for RSA key pair generation was founEPSS 0.4%CVE-2025-29311HIGHLimited secret space in LLDP packets used in onos v2.7.0 allows attackers to obtain the private key via a bruteforce attack. Attackers are aEPSS 0.4%CVE-2025-15387HIGHQNO Technology｜VPN Firewall - Insufficient EntropyEPSS 0.4%CVE-2026-42155CRITICALMagento LTS: Weak API Session ID — Predictable MD5 of Time-Derived InputsEPSS 0.4%CVE-2026-8700HIGHCrypt::DSA versions before 1.20 for Perl generate seeds using randEPSS 0.4%CVE-2024-56370MEDIUMNet::Xero 0.044 and earlier for Perl uses insecure rand() function for cryptographic functionsEPSS 0.4%