CVE-2018-16115: Cryptographically Weak Pseudo-Random Number Generator (PRNG) in akka-actor
Summary
CVE-2018-16115: Cryptographically Weak Pseudo-Random Number Generator (PRNG) in akka-actor. Affects com.typesafe.akka:akka-actor_2.11 versions >= 2.5.0, < 2.5.16. Fixed in 2.5.16. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The akka-actor package is a part of Lightbend Akka, a toolkit and runtime for building highly concurrent, distributed, and fault-tolerant applications on the Java Virtual Machine (JVM). Akka Remoting is a module in Akka that enables communication between actors on different JVMs or even different machines. Akka Remoting uses a random number generator (RNG) for TLS encryption. Akka allows the configuration of custom RNGs, and for historical reasons, it included the AES128CounterSecureRNG and AES256CounterSecureRNG RNGs. However, these custom RNGs had a bug that caused the generated numbers to be repeated after only a few bytes, making them cryptographically weak.
Vulnerability Detail
The vulnerability in akka-actor (2.5.x before 2.5.16) allows for message disclosure and modification due to an RNG error. If the custom AES128CounterSecureRNG or AES256CounterSecureRNG RNGs are enabled in the configuration, an attacker can compromise the communication in Akka Remoting/Cluster. This can lead to eavesdropping, replay attacks, or message modification. The bug in the custom RNG implementations causes the generated numbers to repeat after only a few bytes, making the encryption vulnerable.
How To Fix
Minimum fixed version
2.5.16
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately possible, a workaround is to disable the custom RNGs and use the default RNG provided by Akka. This can be done by removing or commenting out any configuration that specifies the custom RNGs. By using the default RNG, you can avoid the vulnerability until you are able to upgrade to a fixed version.
Conclusion
The vulnerability in akka-actor allows for message disclosure and modification due to a cryptographically weak RNG. To mitigate this vulnerability, it is recommended to upgrade to Akka 2.5.16 or later. If immediate upgrade is not possible, disabling the custom RNGs and using the default RNG provided by Akka can serve as a temporary workaround. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for com.typesafe.akka:akka-actor_2.11 →
FAQ
The vulnerability allows an attacker to compromise the communication in Akka Remoting/Cluster, potentially leading to eavesdropping, replay attacks, or message modification.
No, only versions before 2.5.16 are affected. It is recommended to upgrade to the latest version to fix the vulnerability.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time and alert you if any open-source vulnerabilities are found.
Yes, the CVSS score for this vulnerability is 9.1, indicating a critical severity level.
For more information about this vulnerability, you can refer to the GitHub Advisory Database entry: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2018/10/GHSA-mr95-9rr4-668f/GHSA-mr95-9rr4-668f.json
