7.5
CVE-2022-40769
- EPSS 1.01%
- Veröffentlicht 18.09.2022 17:15:09
- Zuletzt bearbeitet 21.11.2024 07:22:01
- Quelle cve@mitre.org
- CVE-Watchlists
- Unerledigt
Loginprofanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from Ethereum vanity addresses and steal cryptocurrency, as exploited in the wild in June 2022.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Profanity Project ≫ Profanity Version <= 1.60
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 1.01% | 0.585 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 7.5 | 3.9 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
|
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
https://blog.1inch.io/a-vulnerability-disclosed-in-profanity-an-ethereum-vanity-address-tool-68ed7455fc8c
https://github.com/johguse/profanity
https://github.com/johguse/profanity/issues/61