GitHub Advisoryadvisory · Packagist

GHSA-3fmq-x9q6-wm39 random_compat Uses insecure CSPRNG

LOW Published 2024-05-17 Modified 2024-05-17 Official page ↗
Ecosystem
Packagist
Packages
paragonie/random_compat
Severity
Low
Weaknesses
CWE-331
Reviewed
2024-05-17

Affected packages

• Packagist paragonie/random_compat: < 2.0 → fixed in 2.0

Description

random_compat versions prior to 2.0 are affected by a security vulnerability related to the insecure usage of Cryptographically Secure Pseudo-Random Number Generators (CSPRNG). The affected versions use openssl_random_pseudo_bytes(), which may result in insufficient entropy and compromise the security of generated random numbers.

Related

Weakness · CWE (1)

  • CWE-331 Insufficient Entropy weakness

References