GHSA-768m-5w34-2xf5

LTI 1.3 Tool Library's function used to generate random nonces not sufficiently cryptographically complex before v5.0

Source: GitHub Advisory Database (reviewed) High CVE-2022-31157

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	packbackbooks/lti-1-3-php-library	< 5.0	5.0

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact The function used to generate random nonces was not sufficiently cryptographically complex. As a result values may be predictable and tokens may be forgable. ### Patches Users should upgrade to version 5.0 immediately ### Workarounds None.

References

External links from the advisory. They lead to third-party sites.

https://github.com/packbackbooks/lti-1-3-php-library/security/advisories/GHSA-768m-5w34-2xf5 web
https://nvd.nist.gov/vuln/detail/CVE-2022-31157 advisory
https://github.com/packbackbooks/lti-1-3-php-library/commit/de19e8a0b28cdc7750fa3ca98471eeed26ba3e57 web
https://github.com/packbackbooks/lti-1-3-php-library package
https://openid.net/specs/openid-connect-core-1_0.html#IDToken web