CVE-2013-7372

The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in…

published April 29, 2014

CVSS
—
EPSS
2%
Percentile
84.1
In the wild
Unconfirmed
What it is

The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in the SecureRandom implementation in Apache Harmony through 6.0M3, as used in the Java Cryptography Architecture (JCA) in Android before 4.4 and other products, when no seed is provided by the user, uses an incorrect offset value, which makes it easier for attackers to defeat cryptographic protection mechanisms by leveraging the resulting PRNG predictability, as exploited in the wild against Bitcoin wallet applications in August 2013.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02429 · 84.1th percentile
Published
2014-04-29T20:00Z
EPSS history
Timeline
  • 29 APR 20:00Z
    The engineNextBytes function in classlib/modules/security/src/main/java/common/org/apache/harmony/security/provider/crypto/SHA1PRNG_SecureRandomImpl.java in…
    cvelistv5