TYPO3 CMS uses insufficient entropy when generating passwords
The advisory, in context
A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 12.0.0 before 12.4.37
Fixed in 12.4.37
44 explicitly affected versions
v12.0.0, v12.1.0, v12.1.1, v12.1.2, v12.1.3, v12.2.0, v12.3.0, v12.4.0, v12.4.1, v12.4.10, v12.4.11, v12.4.12, v12.4.13, v12.4.14, v12.4.15, v12.4.16, v12.4.17, v12.4.18, v12.4.19, v12.4.2, v12.4.20, v12.4.21, v12.4.22, v12.4.23, v12.4.24, v12.4.25, v12.4.26, v12.4.27, v12.4.28, v12.4.29, v12.4.3, v12.4.30, v12.4.31, v12.4.32, v12.4.33, v12.4.34, v12.4.35, v12.4.36, v12.4.4, v12.4.5, v12.4.6, v12.4.7, v12.4.8, v12.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.4.37"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v12.0.0",
"v12.1.0",
"v12.1.1",
"v12.1.2",
"v12.1.3",
"v12.2.0",
"v12.3.0",
"v12.4.0",
"v12.4.1",
"v12.4.10",
"v12.4.11",
"v12.4.12",
"v12.4.13",
"v12.4.14",
"v12.4.15",
"v12.4.16",
"v12.4.17",
"v12.4.18",
"v12.4.19",
"v12.4.2",
"v12.4.20",
"v12.4.21",
"v12.4.22",
"v12.4.23",
"v12.4.24",
"v12.4.25",
"v12.4.26",
"v12.4.27",
"v12.4.28",
"v12.4.29",
"v12.4.3",
"v12.4.30",
"v12.4.31",
"v12.4.32",
"v12.4.33",
"v12.4.34",
"v12.4.35",
"v12.4.36",
"v12.4.4",
"v12.4.5",
"v12.4.6",
"v12.4.7",
"v12.4.8",
"v12.4.9"
]
}From 13.0.0 before 13.4.18
Fixed in 13.4.18
26 explicitly affected versions
v13.0.0, v13.0.1, v13.1.0, v13.1.1, v13.2.0, v13.2.1, v13.3.0, v13.3.1, v13.4.0, v13.4.1, v13.4.10, v13.4.11, v13.4.12, v13.4.13, v13.4.14, v13.4.15, v13.4.16, v13.4.17, v13.4.2, v13.4.3, v13.4.4, v13.4.5, v13.4.6, v13.4.7, v13.4.8, v13.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "13.0.0"
},
{
"fixed": "13.4.18"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v13.0.0",
"v13.0.1",
"v13.1.0",
"v13.1.1",
"v13.2.0",
"v13.2.1",
"v13.3.0",
"v13.3.1",
"v13.4.0",
"v13.4.1",
"v13.4.10",
"v13.4.11",
"v13.4.12",
"v13.4.13",
"v13.4.14",
"v13.4.15",
"v13.4.16",
"v13.4.17",
"v13.4.2",
"v13.4.3",
"v13.4.4",
"v13.4.5",
"v13.4.6",
"v13.4.7",
"v13.4.8",
"v13.4.9"
]
}