CVEvulnerability
CVE-2019-0729
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2019-03-05
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 7.5 HIGH — AV:N/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-330
Description
An Elevation of Privilege vulnerability exists in the way Azure IoT Java SDK generates symmetric keys for encryption, allowing an attacker to predict the randomness of the key, aka 'Azure IoT Java SDK Elevation of Privilege Vulnerability'.
Affected configurations
• microsoft java software development kit
Related
Weakness · CWE (1)
- CWE-330 Use of Insufficiently Random Values weakness
References
- http://www.securityfocus.com/bid/106966 Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0729 Patch, Vendor Advisory
- http://www.securityfocus.com/bid/106966 Third Party Advisory, VDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0729 Patch, Vendor Advisory