What is GHSA-768m-5w34-2xf5?

GHSA-768m-5w34-2xf5 is a security advisory published by GitHub Security Advisories with High severity. LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0

Which CVE IDs does GHSA-768m-5w34-2xf5 cover?

GHSA-768m-5w34-2xf5 covers the following CVE IDs: CVE-2022-31157. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-768m-5w34-2xf5?

GHSA-768m-5w34-2xf5 has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

Which products are affected by GHSA-768m-5w34-2xf5?

GHSA-768m-5w34-2xf5 affects 1 product, including: composer/packbackbooks/lti-1-3-php-library:\u003c 5.0.

GHSA-768m-5w34-2xf5HighCVSS 7.5

LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0

Vendor

GitHub Security Advisories

Published

July 15, 2022

Last Modified

July 24, 2023

🔗 CVE IDs covered (1)

CVE-2022-31157 →

📋 Description

Impact

The function used to generate random nonces was not sufficiently cryptographically complex. As a result values may be predictable and tokens may be forgable.

Patches

Users should upgrade to version 5.0 immediately

Workarounds

None.

🎯 Affected products1

composer/packbackbooks/lti-1-3-php-library:< 5.0

🔗 References (5)

https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5
https://github.com/packbackbooks/lti-1-3-php-library/commit/de19e8a0b28cdc7750fa3ca98471eeed26ba3e57
https://openid.net/specs/openid-connect-core-1_0.html#IDToken
https://nvd.nist.gov/vuln/detail/CVE-2022-31157
https://github.com/advisories/GHSA-768m-5w34-2xf5