CVE-2007-6755
The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain
02 Description
The NIST SP 800-90A default statement of the Dual Elliptic Curve Deterministic Random Bit Generation (Dual_EC_DRBG) algorithm contains point Q constants with a possible relationship to certain
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 1.63% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 75.7% of scored records. A rank, not a probability.
- NVD base score
- The NVD has published no score for this record
- NVD CVSS vector
- No NVD score to derive
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-16.
- Red Hat severity
- Moderate. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2013-10-11 22:00Z13 YR AGO
- Last updated
- 2024-08-07 16:18Z2 YR AGO
- Reserved
- 2013-10-11
- Assigning CNA
- oracle
- Record state
- PUBLISHED
- Severity
- Not rated by the issuing CNA
- CNA CVSS vector
- Not published by the issuing CNA
- Weaknesses
- CWE-327Use of a Broken or Risky Cryptographic AlgorithmClass
- Data version
- 5.1
- Document digest
- 9539bdf529005b75d9dc31f9dddfbfeb7a4131ea9116b59af71269eb7ef17444
05 Affected products
06 References
- blog.cryptographyengineering.comhttp://blog.cryptographyengineering.com/2013/09/rsa-warns-developers-against-its-own.html
- stream.wsj.comhttp://stream.wsj.com/story/latest-headlines/SS-2-63399/SS-2-332655/
- www.schneier.comhttps://www.schneier.com/blog/archives/2007/11/the_strange_sto.html
- blog.cryptographyengineering.comhttp://blog.cryptographyengineering.com/2013/09/the-many-flaws-of-dualecdrbg.html
- threatpost.comhttp://threatpost.com/in-wake-of-latest-crypto-revelations-everything-is-suspect
- www.securityfocus.com63657http://www.securityfocus.com/bid/63657
- arstechnica.comhttp://arstechnica.com/security/2013/09/stop-using-nsa-influence-code-in-our-product-rsa-tells-customers/
- rump2007.cr.yp.tohttp://rump2007.cr.yp.to/15-shumow.pdf
07 Fixed in
Debian 12
- openssl Fixed in 1.1.0b-2
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- openssl Fixed in 1.1.0b-2
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- openssl Fixed in 1.1.0b-2
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.