CVE-2025-21617

Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1.

CVSS

No CVSS.

References

Link	Resource
https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192
https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53
https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1
https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) El suscriptor de Guzzle OAuth firma las solicitudes de Guzzle mediante OAuth 1.0. Antes de la versión 0.8.1, la generación de Nonce no utiliza suficiente entropía ni una fuente pseudoaleatoria criptográficamente segura. Esto puede dejar a los servidores vulnerables a ataques de repetición cuando no se utiliza TLS. Esta vulnerabilidad se solucionó en la versión 0.8.1.

06 Jan 2025, 20:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2025-01-06 20:15

Updated : 2026-04-15 00:35

NVD link : CVE-2025-21617

Mitre link : CVE-2025-21617

CVE.ORG link : CVE-2025-21617

JSON object : View

Products Affected

No product.

CWE

CWE-338

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

{"id": "CVE-2025-21617", "cveTags": [], "metrics": {"cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-01-06T20:15:39.453", "references": [{"url": "https://github.com/guzzle/oauth-subscriber/blob/0.8.0/src/Oauth1.php#L192", "source": "security-advisories@github.com"}, {"url": "https://github.com/guzzle/oauth-subscriber/commit/92b619b03bd21396e51c62e6bce83467d2ce8f53", "source": "security-advisories@github.com"}, {"url": "https://github.com/guzzle/oauth-subscriber/releases/tag/0.8.1", "source": "security-advisories@github.com"}, {"url": "https://github.com/guzzle/oauth-subscriber/security/advisories/GHSA-237r-r8m4-4q88", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-338"}]}], "descriptions": [{"lang": "en", "value": "Guzzle OAuth Subscriber signs Guzzle requests using OAuth 1.0. Prior to 0.8.1, Nonce generation does not use sufficient entropy nor a cryptographically secure pseudorandom source. This can leave servers vulnerable to replay attacks when TLS is not used. This vulnerability is fixed in 0.8.1."}, {"lang": "es", "value": "El suscriptor de Guzzle OAuth firma las solicitudes de Guzzle mediante OAuth 1.0. Antes de la versi\u00f3n 0.8.1, la generaci\u00f3n de Nonce no utiliza suficiente entrop\u00eda ni una fuente pseudoaleatoria criptogr\u00e1ficamente segura. Esto puede dejar a los servidores vulnerables a ataques de repetici\u00f3n cuando no se utiliza TLS. Esta vulnerabilidad se solucion\u00f3 en la versi\u00f3n 0.8.1."}], "lastModified": "2026-04-15T00:35:42.020", "sourceIdentifier": "security-advisories@github.com"}