The gnu.java.security.util.PRNG class in GNU Classpath 0.97.2 and previous versions uses a predictable seed based on the system time, which makes it easier for context-dependent malicious users to conduct brute force attacks against cryptographic routines that use this class for randomness, as demonstrated against DSA private keys.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
gnu classpath 0.96.1 |
||
gnu classpath 0.95 |
||
gnu classpath 0.93 |
||
gnu classpath 0.17 |
||
gnu classpath 0.16 |
||
gnu classpath 0.9 |
||
gnu classpath 0.8 |
||
gnu classpath 0.92 |
||
gnu classpath 0.91 |
||
gnu classpath |
||
gnu classpath 0.97.1 |
||
gnu classpath 0.90 |
||
gnu classpath 0.20 |
||
gnu classpath 0.13 |
||
gnu classpath 0.12 |
||
gnu classpath 0.15 |
||
gnu classpath 0.14 |
||
gnu classpath 0.7 |
||
gnu classpath 0.6 |
||
gnu classpath 0.97 |
||
gnu classpath 0.96 |
||
gnu classpath 0.19 |
||
gnu classpath 0.18 |
||
gnu classpath 0.11 |
||
gnu classpath 0.10 |
Vulmon