Cryptographic Vulnerability in Facebook HipHop Virtual Machine
CVE-2014-5386

Currently unrated

Key Information:

Vendor

Facebook

Status
Hiphop Virtual Machine
Vendor
CVE Published:
28 December 2014

What is CVE-2014-5386?

The mcrypt_create_iv function in Facebook's HipHop Virtual Machine (HHVM) prior to version 3.3.0 contains a significant security flaw due to the lack of proper seeding in the random number generator. This oversight jeopardizes cryptographic protection mechanisms, allowing remote attackers to exploit predictable initialization vectors. This vulnerability can potentially compromise sensitive information by undermining the effectiveness of encryption protocols.

References

https://github.com/facebook/hhvm/commit/ab6fdeb84fb090b48...
x_refsource_CONFIRM

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.