Vulnerability · Published Jan 6, 2025 · Assigned by GitHub_M

CVE-2025-21617Guzzle OAuth Subscriber has insufficient nonce entropy

Medium 6.3

In plain English

A medium-severity security flaw in oauth-subscriber from guzzle. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 42% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)6.3Medium

Exploit odds (30 days)0.5%top 58.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	guzzlehttp/oauth-subscriber	0.8.1	GHSA-237r-r8m4-4q88

Affected products (as reported)

Vendor	Product	Versions
guzzle	oauth-subscriber	< 0.8.1

Weakness: CWE-338 · Vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88 x_refsource_CONFIRM
https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53 x_refsource_MISC
https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192 x_refsource_MISC
https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1 x_refsource_MISC