CVE-2016-1902

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random…

published June 1, 2016

CVSS
—
EPSS
2%
Percentile
79.5
In the wild
Unconfirmed
What it is

The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random numbers when used with PHP 5.x without the paragonie/random_compat library and the openssl_random_pseudo_bytes function fails, which makes it easier for attackers to defeat cryptographic protection mechanisms via unspecified vectors.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01907 · 79.5th percentile
Published
2016-06-01T22:00Z
EPSS history
Timeline
  • 01 JUN 22:00Z
    The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly generate random…
    cvelistv5