CVE-2017-9371: blackberry qnx_software_development_platform Insufficient Entropy in PRNG

Vulnerability summary

CVE-2017-9371 is a medium (CVSS 5.9) Insufficient Entropy in PRNG vulnerability in blackberry qnx_software_development_platform. EPSS estimates a 0.81% chance of exploitation in the next 30 days, higher than 56% of scored vulnerabilities.

Timeline

1. 14-11-2017
   PublishedVulnerability first disclosed.
2. 22-08-2025
   Last modifiedVulnerability information updated.

Description

In BlackBerry QNX Software Development Platform (SDP) 6.6.0 and 6.5.0 SP1 and earlier, a loss of integrity vulnerability in the default configuration of the QNX SDP could allow an attacker being able to reduce the entropy of the PRNG, making other blended attacks more practical by gaining control over environmental factors that influence seed generation.

• CWE-332Insufficient Entropy in PRNGThe lack of entropy available for, or used by, a Pseudo-Random Number Generator (PRNG) can be a stability and security threat.