Summary
It was discovered that tgt incorrectly tried to achieve entropy by calling
rand without srand. An attacker could possibly use this issue to make tgt
generate an identical sequence of challenges, resulting in authentication
bypass.
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | tgt | 1:1.0.43-0ubuntu4.1~14.04.3+esm1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | tgt | 1:1.0.63-1ubuntu1.1+esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | tgt | 1:1.0.72-1ubuntu1+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | tgt | 1:1.0.80-1ubuntu2+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | tgt | 1:1.0.85-1.1ubuntu6+esm1 |
Vulnerabilities 1
-
Medium 5.9
tgt (aka Linux target framework) before 1.0.93 attempts to achieve entropy by calling rand without srand. The PRNG seed…
References
-
report
https://ubuntu.com/security/CVE-2024-45751