CVE-2025-21617 MEDIUM

CVE-2025-21617: Guzzle OAuth Subscriber has insufficient nonce entropy

Vendor Guzzle
Product oauth-subscriber
Weakness CWE-338
Published January 6, 2025
Last update January 6, 2025
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.

Key dates

02Disclosure timeline

January 6, 2025 CVE published
January 6, 2025 Record updated