CVE-2014-0017

The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator…

published March 14, 2014

CVSS
—
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator (PRNG), which causes the state to be shared between children processes and allows local users to obtain sensitive information by leveraging a pid collision.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00356 · 28.1th percentile
Published
2014-03-14T15:00Z
EPSS history
Timeline
  • 14 MAR 15:00Z
    The RAND_bytes function in libssh before 0.6.3, when forking is enabled, does not properly reset the state of the OpenSSL pseudo-random number generator…
    cvelistv5