GitHub Advisoryadvisory · Packagist

GHSA-768m-5w34-2xf5 LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0

HIGH Published 2022-07-15 Modified 2022-07-25 Official page ↗
Aliases
CVE-2022-31157
Ecosystem
Packagist
Packages
packbackbooks/lti-1-3-php-library
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-327, CWE-330
Reviewed
2022-07-15

Affected packages

• Packagist packbackbooks/lti-1-3-php-library: < 5.0 → fixed in 5.0

Description

Impact The function used to generate random nonces was not sufficiently cryptographically complex. As a result values may be predictable and tokens may be forgable. Patches Users should upgrade to version 5.0 immediately Workarounds None.

Related

Alias · CVE (1)

  • CVE-2022-31157 LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. vulnerability

Weakness · CWE (2)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness
  • CWE-330 Use of Insufficiently Random Values weakness

References