{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "ADJACENT_NETWORK",
              "availabilityImpact": "NONE",
              "baseScore": 6.5,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "NONE",
              "privilegesRequired": "NONE",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2018-9426",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-12-03T14:59:30.299610Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-331",
                "description": "CWE-331 Insufficient Entropy",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-12-03T15:07:45.180Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Android",
          "vendor": "Google",
          "versions": [
            {
              "status": "affected",
              "version": "7"
            },
            {
              "status": "affected",
              "version": "7.1.1"
            },
            {
              "status": "affected",
              "version": "7.1.2"
            },
            {
              "status": "affected",
              "version": "8"
            },
            {
              "status": "affected",
              "version": "8.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eIn \u0026nbsp;RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java,\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003ean incorrect implementation could cause weak RSA key pairs being generated.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eThis could lead to crypto vulnerability with no additional execution\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eprivileges needed. User interaction is not needed for exploitation.\u0026nbsp;\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eBulletin Fix: The fix is designed to correctly implement the key generation according to FIPS standard.\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "In \u00a0RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java,\u00a0an incorrect implementation could cause weak RSA key pairs being generated.\u00a0This could lead to crypto vulnerability with no additional execution\u00a0privileges needed. User interaction is not needed for exploitation.\u00a0Bulletin Fix: The fix is designed to correctly implement the key generation according to FIPS standard."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-02T21:30:27.265Z",
        "orgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
        "shortName": "google_android"
      },
      "references": [
        {
          "url": "https://source.android.com/docs/security/bulletin/pixel/2018-07-01"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "baff130e-b8d5-4e15-b3d3-c3cf5d5545c6",
    "assignerShortName": "google_android",
    "cveId": "CVE-2018-9426",
    "datePublished": "2024-12-02T21:30:27.265Z",
    "dateReserved": "2018-04-05T00:00:00.000Z",
    "dateUpdated": "2024-12-03T15:07:45.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"ADJACENT_NETWORK\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"HIGH\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2018-9426\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-12-03T14:59:30.299610Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-331\", \"description\": \"CWE-331 Insufficient Entropy\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-03T15:07:07.293Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"affected\": [{\"vendor\": \"Google\", \"product\": \"Android\", \"versions\": [{\"status\": \"affected\", \"version\": \"7\"}, {\"status\": \"affected\", \"version\": \"7.1.1\"}, {\"status\": \"affected\", \"version\": \"7.1.2\"}, {\"status\": \"affected\", \"version\": \"8\"}, {\"status\": \"affected\", \"version\": \"8.1\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://source.android.com/docs/security/bulletin/pixel/2018-07-01\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In \\u00a0RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java,\\u00a0an incorrect implementation could cause weak RSA key pairs being generated.\\u00a0This could lead to crypto vulnerability with no additional execution\\u00a0privileges needed. User interaction is not needed for exploitation.\\u00a0Bulletin Fix: The fix is designed to correctly implement the key generation according to FIPS standard.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eIn \u0026nbsp;RsaKeyPairGenerator::getNumberOfIterations of RSAKeyPairGenerator.java,\u0026nbsp;\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003ean incorrect implementation could cause weak RSA key pairs being generated.\u0026nbsp;\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eThis could lead to crypto vulnerability with no additional execution\u0026nbsp;\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eprivileges needed. User interaction is not needed for exploitation.\u0026nbsp;\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eBulletin Fix: The fix is designed to correctly implement the key generation according to FIPS standard.\u003c/span\u003e\u003cbr\u003e\", \"base64\": false}]}], \"providerMetadata\": {\"orgId\": \"baff130e-b8d5-4e15-b3d3-c3cf5d5545c6\", \"shortName\": \"google_android\", \"dateUpdated\": \"2024-12-02T21:30:27.265Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2018-9426\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-12-03T15:07:45.180Z\", \"dateReserved\": \"2018-04-05T00:00:00.000Z\", \"assignerOrgId\": \"baff130e-b8d5-4e15-b3d3-c3cf5d5545c6\", \"datePublished\": \"2024-12-02T21:30:27.265Z\", \"assignerShortName\": \"google_android\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}