Bug 2381959 (CVE-2025-7783)
| Summary: | CVE-2025-7783 form-data: Unsafe random function in form-data | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | aarif, aazores, abarbaro, abrianik, adkhan, adudiak, alcohan, anjoseph, anpicker, aprice, asoldano, ataylor, bbaranow, bdettelb, bmaxwell, bparees, brasmith, brian.stansberry, caswilli, cdewolf, chfoley, cmah, cochase, crizzo, darran.lofthouse, dbosanac, dbruscin, dfreiber, dhanak, dkreling, dkuc, doconnor, dosoudil, dranck, drosa, drow, dsimansk, dymurray, eaguilar, ebaron, eric.wittmann, fdeutsch, fjansen, fjuma, ggrzybek, gmalinko, gotiwari, gparvin, gryan, gzaronik, haoli, hasun, hkataria, ibek, ibolton, istudens, ivassile, iweiss, jajackso, janstey, jburrell, jcammara, jcantril, jchui, jfula, jhe, jhuff, jkoehler, jmatthew, jmitchel, jmontleo, jneedle, jolong, jowilson, jprabhak, jreimann, jrokos, jscholz, jwendell, jwong, kaycoth, kegrant, kingland, koliveir, kshier, ktsao, kvanderr, kverlaen, lball, lchilton, lgao, lphiri, mabashia, manissin, matzew, mdessi, mnovotny, mosmerov, mpierce, mrizzi, msochure, msvehla, mvyas, mwringe, nboldt, ngough, nipatil, njean, nwallace, nyancey, omaciel, ometelka, oramraz, owatkins, pahickey, pantinor, parichar, pbizzarr, pbraun, pcattana, pdelbell, periklis, pesilva, pgaikwad, pjindal, pmackay, psrna, ptisnovs, rcernich, rhaigner, rjohnson, rkubis, rojacob, rstancel, rstepani, sausingh, sdawley, sdoran, sfeifer, shvarugh, simaishi, slucidi, smaestri, smcdonal, smullick, sseago, stcannon, stirabos, swoodman, syedriko, tasato, teagle, tfister, thason, thavo, tom.jenkinson, ttakamiy, veshanka, vkumar, wtam, xdharmai, yguenane |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A vulnerability related to predictable random number generation has been discovered in the form-data JavaScript library. The library utilizes Math.random() to determine boundary values for multipart form-encoded data.
This presents a security risk if an attacker can observe other values generated by Math.random() within the target application and simultaneously control at least one field of a request made using form-data. Under these conditions, the attacker could potentially predict or determine the boundary values. This predictability could be leveraged to bypass security controls, manipulate form data, or potentially lead to data integrity issues or other forms of exploitation.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2382003, 2382004, 2382008, 2382009, 2382010, 2382011, 2382012, 2382013, 2382016, 2382018, 2382019, 2382020, 2382021, 2382022, 2382023, 2382026, 2382001, 2382002, 2382005, 2382006, 2382007, 2382014, 2382015, 2382017, 2382024, 2382025, 2382027, 2383546 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2025-07-18 17:01:07 UTC
This issue has been addressed in the following products: Cryostat 4 on RHEL 9 Via RHSA-2025:14919 https://access.redhat.com/errata/RHSA-2025:14919 This issue has been addressed in the following products: multicluster engine for Kubernetes 2.8 for RHEL 9 multicluster engine for Kubernetes 2.8 for RHEL 8 Via RHSA-2025:16101 https://access.redhat.com/errata/RHSA-2025:16101 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.13 for RHEL 9 Via RHSA-2025:16113 https://access.redhat.com/errata/RHSA-2025:16113 This issue has been addressed in the following products: multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster engine for Kubernetes 2.7 for RHEL 9 Via RHSA-2025:18278 https://access.redhat.com/errata/RHSA-2025:18278 This issue has been addressed in the following products: Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 Via RHSA-2025:18744 https://access.redhat.com/errata/RHSA-2025:18744 |