{"id":"GHSA-q8fc-v85f-78pw","aliases":[],"title":"stormpath/sdk uses Insecure Random Number Generator","titleSource":"OSV","descriptionSource":"OSV","declaredSeverity":"MODERATE","description":"The vulnerability pertains to the usage of an insecure random number generator (RNG) in the \"stormpath-sdk-php\" library. Specifically, the issue is present in the generation of UUID (Universally Unique Identifier) version 4 within the codebase.\n","severity":"medium","score":5.3,"published":"2024-05-29T13:09:29.000Z","modified":"2024-12-04T05:40:09.638Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"stormpath/sdk","sources":[{"name":"OSV · GHSA-q8fc-v85f-78pw","url":"https://osv.dev/vulnerability/GHSA-q8fc-v85f-78pw"}],"ranges":[{"events":[{"introduced":"0"},{"last_affected":"1.19.0"}],"type":"ECOSYSTEM"}],"versions":["0.1.0","0.2.0","0.3.0","0.3.1","0.3.2","1.0.0.beta","1.0.1.beta","1.1.0.beta","1.10.0.beta","1.11.0.beta","1.12.0","1.12.1","1.12.2","1.13.0","1.14.0","1.15.0","1.16.0","1.17.0","1.17.1","1.17.2","1.18.0","1.19.0","1.2.0.beta","1.2.1.beta","1.3.0.beta","1.4.0.beta","1.5.0.beta","1.6.0.beta","1.7.0.beta","1.8.0.beta","1.8.1.beta","1.9.0.beta"],"fixed":[]}],"sourceAffected":[],"references":["https://github.com/stormpath/stormpath-sdk-php/issues/132","https://github.com/FriendsOfPHP/security-advisories/blob/master/stormpath/sdk/2017-11-20.yaml","https://github.com/stormpath/stormpath-sdk-php","https://github.com/stormpath/stormpath-sdk-php/blob/15aee3007b8aa41c20cdf28fd650b8a2368a7fa9/src/Util/UUID.php#L167-L181","https://github.com/stormpath/stormpath-sdk-php/blob/62698ea98ef89217f932e28cf3e511d39af3b4cf/src/Authc/Api/ApiKeyEncryptionOptions.php#L48-L50"],"sources":[{"name":"OSV","id":"GHSA-q8fc-v85f-78pw","modified":"2024-12-04T05:40:09.638665Z","url":"https://osv.dev/vulnerability/GHSA-q8fc-v85f-78pw"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","score":5.3}],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T18:15:34.797Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}