Vulnerability · Published Jul 15, 2022 · Assigned by GitHub_M
CVE-2022-31157Use of a Broken or Risky Cryptographic Algorithm in packbackbooks/lti-1-3-php-library
High 7.5
In plain English
A high-severity broken cryptography in lti-1-3-php-library from packbackbooks. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 39% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
LTI 1.3 Tool Library is a library used for building IMS-certified LTI 1.3 tool providers in PHP. Prior to version 5.0, the function used to generate random nonces was not sufficiently cryptographically complex. Users should upgrade to version 5.0 to receive a patch. There are currently no known workarounds.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | packbackbooks/lti-1-3-php-library | 5.0 | GHSA-768m-5w34-2xf5 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| packbackbooks | lti-1-3-php-library | < 5.0 |
Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N