CVE-2018-11045: Pivotal Software Operations Manager

Medium severity, CVSS 5.9. EPSS: 0.9% chance of exploitation in the next 30 days.

Pivotal Operations Manager, versions 2.1 prior to 2.1.6 and 2.0 prior to 2.0.15 and 1.12 prior to 1.12.22, contains a static Linux Random Number Generator (LRNG) seed file embedded in the appliance image. An attacker with knowledge of the exact version and IaaS of a running OpsManager could get the contents of the corresponding seed from the published image and therefore infer the initial state of the LRNG.

Affected products

• Pivotal Software Operations Manager: from 1.12, before 1.12.22 (fixed in 1.12.22); after 2.0, before 2.0.15 (fixed in 2.0.15); from 2.1.0, before 2.1.6 (fixed in 2.1.6)

Published 2018-07-11. Last modified 2026-06-17.