CVE-2022-33738
06.07.2022, 16:15
OpenVPN Access Server before 2.11 uses a weak random generator used to create user session token for the web portal
| Vendor | Product | Version |
|---|---|---|
| openvpn | openvpn_access_server | 𝑥 < 2.11.0 |
𝑥
= Vulnerable software versions
Common Weakness Enumeration
- CWE-331 - Insufficient EntropyThe software uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
- CWE-338 - Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.