{"id":"GHSA-q8fc-v85f-78pw","aliases":[],"status":"published","title":"stormpath/sdk uses Insecure Random Number Generator","description":"The vulnerability pertains to the usage of an insecure random number generator (RNG) in the \"stormpath-sdk-php\" library. Specifically, the issue is present in the generation of UUID (Universally Unique Identifier) version 4 within the codebase.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-338"],"published":"2024-05-29T13:09:29Z","modified":"2024-12-04T05:40:09Z","affected":[{"source":"ghsa","ecosystem":"Packagist","package":"stormpath/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.19.0"}]}]},{"source":"osv","ecosystem":"Packagist","package":"stormpath/sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.19.0"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.3.1","0.3.2","1.0.0.beta","1.0.1.beta","1.1.0.beta","1.10.0.beta","1.11.0.beta","1.12.0","1.12.1","1.12.2","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.17.1","1.17.2","1.18.0","1.19.0","1.2.0.beta","1.2.1.beta","1.3.0.beta","1.4.0.beta","1.5.0.beta","1.6.0.beta","1.7.0.beta","1.8.0.beta","1.8.1.beta","1.9.0.beta"]}],"references":[{"url":"https://github.com/stormpath/stormpath-sdk-php/issues/132","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/stormpath/sdk/2017-11-20.yaml","tags":["web"]},{"url":"https://github.com/stormpath/stormpath-sdk-php/blob/15aee3007b8aa41c20cdf28fd650b8a2368a7fa9/src/Util/UUID.php#L167-L181","tags":["web"]},{"url":"https://github.com/stormpath/stormpath-sdk-php/blob/62698ea98ef89217f932e28cf3e511d39af3b4cf/src/Authc/Api/ApiKeyEncryptionOptions.php#L48-L50","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q8fc-v85f-78pw"},{"url":"https://github.com/stormpath/stormpath-sdk-php","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-q8fc-v85f-78pw","title":"stormpath/sdk uses Insecure Random Number Generator","description":"The vulnerability pertains to the usage of an insecure random number generator (RNG) in the \"stormpath-sdk-php\" library. Specifically, the issue is present in the generation of UUID (Universally Unique Identifier) version 4 within the codebase.\n","status":"published","published":"2024-05-29T13:09:29Z","modified":"2024-05-29T13:09:30Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:37:52.2286Z"}],"osv":[{"id":"GHSA-q8fc-v85f-78pw","title":"stormpath/sdk uses Insecure Random Number Generator","description":"The vulnerability pertains to the usage of an insecure random number generator (RNG) in the \"stormpath-sdk-php\" library. Specifically, the issue is present in the generation of UUID (Universally Unique Identifier) version 4 within the codebase.\n","status":"published","published":"2024-05-29T13:09:29Z","modified":"2024-12-04T05:40:09.638665Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:46:54.40888Z"}]}}