CVE-2021-34430
08.07.2021, 03:15
Eclipse TinyDTLS through 0.9-rc1 relies on the rand function in the C library, which makes it easier for remote attackers to compute the master key and then decrypt DTLS traffic.
| Vendor | Product | Version |
|---|---|---|
| eclipse | tinydtls | 𝑥 ≤ 0.8.2 |
| eclipse | tinydtls | 0.9:rc1 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
- CWE-326 - Inadequate Encryption StrengthThe software stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.