CVE-2025-4894

calmkart Django-sso-server crypto.py gen_rsa_keys inadequate encryption

State: Published
Severity: 6.3 Medium
Published: May 18, 2025
Updated: May 19, 2025
Reserved: May 17, 2025

Description

A vulnerability classified as problematic was found in calmkart Django-sso-server up to 057247929a94ffc358788a37ab99e391379a4d15. This vulnerability affects the function gen_rsa_keys of the file common/crypto.py. The manipulation leads to inadequate encryption strength. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available.

Scores

CVSS	Score	Vector	Source
4.0	6.3 Medium	CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N	VulDB
3.1	3.7 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	VulDB
3.0	3.7 Low	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N	VulDB
2.0	2.6 Low	AV:N/AC:H/Au:N/C:P/I:N/A:N	VulDB

Weaknesses

CWE-326 Inadequate Encryption Strength
CWE-310 Cryptographic Issues

Affected Products

Product	Versions
Django-sso-servercalmkart	057247929a94ffc358788a37ab99e391379a4d15Affected

References

VDB-309448 | calmkart Django-sso-server crypto.py gen_rsa_keys inadequate encryptionvdb-entrytechnical-description
VDB-309448 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
Submit #578019 | https://github.com/calmkart Django-sso-server master CWE-326: Inadequate Encryption Strengththird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.