Bug 2381959 (CVE-2025-7783)

Summary: CVE-2025-7783 form-data: Unsafe random function in form-data
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aarif, aazores, abarbaro, abrianik, adkhan, adudiak, alcohan, anjoseph, anpicker, aprice, asoldano, ataylor, bbaranow, bdettelb, bmaxwell, bparees, brasmith, brian.stansberry, caswilli, cdewolf, chfoley, cmah, cochase, crizzo, darran.lofthouse, dbosanac, dbruscin, dfreiber, dhanak, dkreling, dkuc, doconnor, dosoudil, dranck, drosa, drow, dsimansk, dymurray, eaguilar, ebaron, eric.wittmann, fdeutsch, fjansen, fjuma, ggrzybek, gmalinko, gotiwari, gparvin, gryan, gzaronik, haoli, hasun, hkataria, ibek, ibolton, istudens, ivassile, iweiss, jajackso, janstey, jburrell, jcammara, jcantril, jchui, jfula, jhe, jhuff, jkoehler, jmatthew, jmitchel, jmontleo, jneedle, jolong, jowilson, jprabhak, jreimann, jrokos, jscholz, jwendell, jwong, kaycoth, kegrant, kingland, koliveir, kshier, ktsao, kvanderr, kverlaen, lball, lchilton, lgao, lphiri, mabashia, manissin, matzew, mdessi, mnovotny, mosmerov, mpierce, mrizzi, msochure, msvehla, mvyas, mwringe, nboldt, ngough, nipatil, njean, nwallace, nyancey, omaciel, ometelka, oramraz, owatkins, pahickey, pantinor, parichar, pbizzarr, pbraun, pcattana, pdelbell, periklis, pesilva, pgaikwad, pjindal, pmackay, psrna, ptisnovs, rcernich, rhaigner, rjohnson, rkubis, rojacob, rstancel, rstepani, sausingh, sdawley, sdoran, sfeifer, shvarugh, simaishi, slucidi, smaestri, smcdonal, smullick, sseago, stcannon, stirabos, swoodman, syedriko, tasato, teagle, tfister, thason, thavo, tom.jenkinson, ttakamiy, veshanka, vkumar, wtam, xdharmai, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random() to determine boundary values for multipart form-encoded data. This presents a security risk if an attacker can observe other values generated by Math.random() within the target application and simultaneously control at least one field of a request made using form-data. Under these conditions, the attacker could potentially predict or determine the boundary values. This predictability could be leveraged to bypass security controls, manipulate form data, or potentially lead to data integrity issues or other forms of exploitation.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2382003, 2382004, 2382008, 2382009, 2382010, 2382011, 2382012, 2382013, 2382016, 2382018, 2382019, 2382020, 2382021, 2382022, 2382023, 2382026, 2382001, 2382002, 2382005, 2382006, 2382007, 2382014, 2382015, 2382017, 2382024, 2382025, 2382027, 2383546    
Bug Blocks:    

Description OSIDB Bzimport 2025-07-18 17:01:07 UTC
Use of Insufficiently Random Values vulnerability in form-data allows HTTP Parameter Pollution (HPP). This vulnerability is associated with program files lib/form_data.Js.

This issue affects form-data: < 2.5.4, 3.0.0 - 3.0.3, 4.0.0 - 4.0.3.

Comment 3 errata-xmlrpc 2025-09-03 02:15:29 UTC
This issue has been addressed in the following products:

  Cryostat 4 on RHEL 9

Via RHSA-2025:14919 https://access.redhat.com/errata/RHSA-2025:14919

Comment 5 errata-xmlrpc 2025-09-17 15:01:58 UTC
This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.8 for RHEL 9
  multicluster engine for Kubernetes 2.8 for RHEL 8

Via RHSA-2025:16101 https://access.redhat.com/errata/RHSA-2025:16101

Comment 6 errata-xmlrpc 2025-09-17 16:57:37 UTC
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9

Via RHSA-2025:16113 https://access.redhat.com/errata/RHSA-2025:16113

Comment 7 errata-xmlrpc 2025-10-18 03:50:41 UTC
This issue has been addressed in the following products:

  multicluster engine for Kubernetes 2.7 for RHEL 8
  multicluster engine for Kubernetes 2.7 for RHEL 9

Via RHSA-2025:18278 https://access.redhat.com/errata/RHSA-2025:18278

Comment 8 errata-xmlrpc 2025-10-21 03:15:06 UTC
This issue has been addressed in the following products:

  Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9

Via RHSA-2025:18744 https://access.redhat.com/errata/RHSA-2025:18744