CVE-2020-11616: Weak RNG
Published Oct 29, 2020
·Updated
NVIDIA DGX servers, all BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which the Pseudo-Random Number Generator (PRNG) algorithm used in the JSOL package that implements the IPMI protocol is not cryptographically strong, which may lead to information disclosure.
Affected Software
2 affected components
Intel BMC firmware<3.38.30
Nvidia DGX-1
Event History
Oct 29, 2020
CVE Published
via MITRE·03:35 AM
Data Sourced
via MITRE·03:35 AM
DescriptionWeakness
Frequently Asked Questions
1
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2020-11616.
2
What is the severity of CVE-2020-11616?
The severity of CVE-2020-11616 is high with a value of 7.5.
3
Which software is affected by CVE-2020-11616?
The affected software is Intel BMC Firmware versions prior to 3.38.30 and NVIDIA DGX-1 servers.
4
What is the impact of CVE-2020-11616?
CVE-2020-11616 may lead to information disclosure due to a weak PRNG algorithm in the AMI BMC firmware.
5
How do I fix CVE-2020-11616?
To fix CVE-2020-11616, update the BMC firmware to version 3.38.30 or later.