Description
In GLPI after version 0.83.3 and before version 9.4.6, the CSRF tokens are generated using an insecure algorithm. The implementation uses rand and uniqid and MD5 which does not provide secure values. This is fixed in version 9.4.6.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| glpi-project | GLPI | > 0.83.3, < 9.4.6 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | glpi | No fix yet | — |
References
- https://github.com/glpi-project/glpi/security/advisories/GHSA-w7q8-58qp-vmpf
- FEDORA-2020-ee30e1109f vendor-advisory
- FEDORA-2020-885e2343ed vendor-advisory