CVEvulnerability

CVE-2019-15703

7.5 HIGH Published 2019-10-24 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-10-24
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0 ([email protected])
2.6 LOW — AV:N/AC:H/Au:N/C:P/I:N/A:N
Weaknesses
CWE-331

Description

An Insufficient Entropy in PRNG vulnerability in Fortinet FortiOS 6.2.1, 6.2.0, 6.0.8 and below for device not enable hardware TRNG token and models not support builtin TRNG seed allows attacker to theoretically recover the long term ECDSA secret in a TLS client with a RSA handshake and mutual ECDSA authentication via the help of flush+reload side channel attacks in FortiGate VM models only.

Affected configurations

• fortinet fortios (<= 5.6.9) • fortinet fortios (>= 6.0.0 < 6.0.9) • fortinet fortios (>= 6.2.0 < 6.2.3)

Related

Weakness · CWE (1)

  • CWE-331 Insufficient Entropy weakness

References