CVE-2021-3689: Use of Insufficiently Random Values in yiisoft/yii2-dev
Summary
CVE-2021-3689: Use of Insufficiently Random Values in yiisoft/yii2-dev. Affects yiisoft/yii2-dev versions < 2.0.43. Fixed in 2.0.43. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The yiisoft/yii2-dev package is a development package for the Yii2 framework. It provides additional tools and features for Yii2 application development. The package is widely used in PHP web development projects. However, it is vulnerable to a Use of Predictable Algorithm in Random Number Generator vulnerability.
Vulnerability Detail
The vulnerability in yiisoft/yii2-dev arises from the use of an insufficiently random algorithm in its random number generator. This can lead to the generation of predictable values, which can be exploited by attackers to bypass security measures or perform cryptographic attacks. The vulnerability has a CVSS score of 7.5, indicating a high severity level. It can potentially result in the compromise of sensitive data or unauthorized access to systems.
How To Fix
Minimum fixed version
2.0.43
This is the first release that contains the fix.
composer require yiisoft/yii2-dev:2.0.43Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The yiisoft/yii2-dev package is vulnerable to a Use of Predictable Algorithm in Random Number Generator vulnerability. It is crucial for developers to update their dependencies and rebuild their applications with the fixed version of the package (2.0.43 or later) to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for yiisoft/yii2-dev →
FAQ
The vulnerability can lead to the compromise of sensitive data or unauthorized access to systems.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. It analyzes your composer.lock file and provides real-time alerts for open-source vulnerabilities.
No, there is no known workaround for this vulnerability. It is recommended to update the yiisoft/yii2-dev package to the fixed version.
There are no known public exploits for this vulnerability at the time of this report. However, it is advisable to update the package to mitigate the risk.
You can find more information about this vulnerability in the GitHub Advisory Database (https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/09/GHSA-hq3v-rg6f-6hx4/GHSA-hq3v-rg6f-6hx4.json).
Related vulnerabilities
Recent vulnerabilities recorded for yiisoft/yii2-dev.
