Nonce Entropy Flaw in GoAhead WebServer by AeroQuad
CVE-2021-41615

9.8CRITICAL

Key Information:

Vendor

Embedthis

Status
Goahead
Vendor
CVE Published:
8 August 2022

What is CVE-2021-41615?

The GoAhead WebServer 2.1.8 is affected by a vulnerability due to insufficient nonce entropy. This occurs because the nonce calculation relies on a hardcoded value that does not adhere to the secret-data guidelines specified in relevant RFCs. Although this version dates back to 2003, its code appears in various derivative works that could still be in operation today. Users of more recent versions of GoAhead software are not impacted by this issue.

References

https://devel.rtems.org/browser/rtems/cpukit/httpd/websda...
x_refsource_MISC
https://github.com/trenta3/goahead-versions/blob/master/2...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.