CVEvulnerability

CVE-2001-0950

7.5 HIGH Published 2001-12-04 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2001-12-04
Last modified
2026-06-16
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
Weaknesses
CWE-331

Description

ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs using the C rand function, or (2) generate certificates or keys using /dev/urandom instead of another source which blocks when the entropy pool is low, which could make it easier for local or remote attackers to steal tokens or certificates via brute force guessing.

Affected configurations

• valicert enterprise validation authority (>= 3.3 <= 4.2.1)

Related

Weakness · CWE (1)

  • CWE-331 Insufficient Entropy weakness

Referenced by CWE · observed example (1)

  • CWE-331 Insufficient Entropy weakness

References