CVE-2021-34430 - OpenCVE

Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic.

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact Partial

Integrity Impact None

Availability Impact None

AV:N/AC:L/Au:N/C:P/I:N/A:N

Vendors & Products
CPE Configurations

Vendors	Products
Eclipse	Tinydtls

Configuration 1 [-]

OR	cpe:2.3:a:eclipse:tinydtls::::::::
	cpe:2.3:a:eclipse:tinydtls:0.9:rc1::::::

References

Link	Resource
https://bugs.eclipse.org/bugs/show_bug.cgi?id=568803	Exploit Issue Tracking Vendor Advisory

History

No history.

MITRE Information

Status: PUBLISHED

Assigner: eclipse

Published: 2021-07-08T03:00:10

Updated: 2021-07-08T03:00:10

Reserved: 2021-06-09T00:00:00

Link: CVE-2021-34430

JSON object: View

NVD Information

Status : Analyzed

Published: 2021-07-08T03:15:07.643

Modified: 2021-07-12T15:50:33.367

Link: CVE-2021-34430

JSON object: View

Redhat Information

No data.

CWE

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:tinydtls:*:*:*:*:*:*:*:*", "matchCriteriaId": "707B94F7-0133-4C8C-B06F-C75AE4AFDF30", "versionEndIncluding": "0.8.2", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:tinydtls:0.9:rc1:*:*:*:*:*:*", "matchCriteriaId": "E6F6D602-748C-4FE8-A5DC-69581B5FF326", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic."}, {"lang": "es", "value": "Eclipse TinyDTLS versiones hasta 0.9-rc1 se basa en la funci\u00f3n rand de la biblioteca C, lo que facilita a atacantes remotos el c\u00e1lculo de la clave maestra y luego el descifrado del tr\u00e1fico DTLS"}], "id": "CVE-2021-34430", "lastModified": "2021-07-12T15:50:33.367", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2021-07-08T03:15:07.643", "references": [{"source": "emo@eclipse.org", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://bugs.eclipse.org/bugs/show_bug.cgi?id=568803"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-326"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-338"}], "source": "emo@eclipse.org", "type": "Secondary"}]}