CVE-2016-1902: High severity debian linux vulnerability
CVE-2016-1902: SecureRandom's fallback not secure when OpenSSL fails
Other sources
The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/randomcompat library and the opensslrandompseudobytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.
— GitHub
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-1902?
CVE-2016-1902 has been classified as a medium severity vulnerability due to its impact on the randomness of generated numbers.
How do I fix CVE-2016-1902?
To fix CVE-2016-1902, upgrade Symfony to version 2.7.9, 2.6.13, or 2.3.37 or later.
What versions of Symfony are affected by CVE-2016-1902?
CVE-2016-1902 affects Symfony versions prior to 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9.
What is the impact of CVE-2016-1902?
The impact of CVE-2016-1902 is that it can lead to predictable random number generation in applications using affected versions of Symfony.
Is there a workaround for CVE-2016-1902?
There is no known workaround for CVE-2016-1902, and upgrading to a patched version is recommended.