7.5high
CVE-2019-1997
In random_get_bytes of random.c, there is a possible degradation of randomness due to an insecure default value.
Published 7 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.9%
percentile 59%
Public exploits
0
none known
Summary
In random_get_bytes of random.c, there is a possible degradation of randomness due to an insecure default value. This could lead to local information disclosure via an insecure wireless connection with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-117508900.
Exploit prediction (EPSS)
0.86% probability of exploitation in the next 30 days, higher than 59% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Android Android
Classification
- Weakness
- CWE-330 Use of Insufficiently Random Values
References
- source.android.com /security/bulletin/2019-02-01 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/106946 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2019-1997
- NVD: CVE-2019-1997
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.