What’s Vulnerable › Vulnerabilities

CVE-2001-0950

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2001-12-04 · updated 2026-06-16
• Weakness: CWE-331

Description

ValiCert Enterprise Validation Authority (EVA) Administration Server 3.3 through 4.2.1 uses insufficiently random data to (1) generate session tokens for HSMs using the C rand function, or (2) generate certificates or keys using /dev/urandom instead of another source which blocks when the entropy pool is low, which could make it easier for local or remote attackers to steal tokens or certificates via brute force guessing.

Affected products

• Valicert Enterprise Validation Authority: from 3.3 through 4.2.1

References

• http://marc.info/?l=bugtraq&m=100749428517090&w=2
• http://www.securityfocus.com/bid/3618
• http://www.securityfocus.com/bid/3620
• http://www.valicert.com/support/security_advisory_eva.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7651
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7653
• http://marc.info/?l=bugtraq&m=100749428517090&w=2
• http://www.securityfocus.com/bid/3618
• http://www.securityfocus.com/bid/3620
• http://www.valicert.com/support/security_advisory_eva.html
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7651
• https://exchange.xforce.ibmcloud.com/vulnerabilities/7653

Get alerted when CVE-2001-0950 or the next vulnerability affects your stack