CVE-2019-11842: Weak RNG
First published: Thu May 09 2019(Updated: )
An issue was discovered in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1. Random number generation is mishandled, which makes it easier for attackers to predict a Sydent authentication token or a Synapse random ID.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Matrix Sydent | <1.0.3 | |
| Matrix Synapse | <0.99.3.1 | |
| pip/matrix-synapse | <0.99.3.1 | 0.99.3.1 |
| pip/matrix-sydent | <1.0.3 | 1.0.3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a/
- https://nvd.nist.gov/vuln/detail/CVE-2019-11842
- https://github.com/advisories/GHSA-gwf7-vfjf-wf6x (Advisory)
- https://github.com/pypa/advisory-database/tree/main/vulns/matrix-synapse/PYSEC-2019-185.yaml
- https://matrix.org/blog/2019/05/03/security-updates-sydent-1-0-3-synapse-0-99-3-1-and-riot-android-0-9-0-0-8-99-0-8-28-a
Frequently Asked Questions
What is the vulnerability CVE-2019-11842?
CVE-2019-11842 is an issue in Matrix Sydent before 1.0.3 and Synapse before 0.99.3.1 where random number generation is mishandled, making it easier for attackers to predict a Sydent authentication token or a Synapse random ID.
Which software is affected by CVE-2019-11842?
Matrix Sydent versions up to and excluding 1.0.3 and Matrix Synapse versions up to and excluding 0.99.3.1 are affected by CVE-2019-11842.
What is the severity of CVE-2019-11842?
The severity of CVE-2019-11842 is high with a CVSS score of 7.5.
How can attackers exploit CVE-2019-11842?
Attackers can exploit CVE-2019-11842 by predicting a Sydent authentication token or a Synapse random ID due to mishandled random number generation.
Is there a fix available for CVE-2019-11842?
Yes, a fix for CVE-2019-11842 is available. Matrix Sydent version 1.0.3 and Matrix Synapse version 0.99.3.1 and above address this vulnerability.
- collector/nvd-index
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/description
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-gwf7-vfjf-wf6x
- alias/CVE-2019-11842
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/severity
- agent/references
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- source/NVD
- agent/author
- agent/tags
- agent/trending
- vendor/matrix
- canonical/matrix sydent
- canonical/matrix synapse
- package-manager/pip