The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twist…
High CVSS 8.1
Summary
The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and the Mersenne Twister internal state is approximately 19,937 bits, so an attacker who observes approximately 334 session IDs (for example via the X-Urwid-ID HTTP response header) can fully reco…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/urwid/urwid
- https://github.com/urwid/urwid/commit/24acd12f0d0598036d0d577f2ee63e4a27b4a3d9
- https://github.com/urwid/urwid/issues/1127
- https://github.com/urwid/urwid/pull/1128
- https://github.com/urwid/urwid/security/advisories/GHSA-rjwp-g85x-gmjv
- https://www.vulncheck.com/advisories/insecure-prng-and-information-exposure-in-urwid-web-display-backend
Timeline
- nvd_ingest NVD