GitHub Advisoryadvisory · npm

GHSA-6qqf-vvcr-7qrv Cryptographically Weak PRNG in generate-password

MEDIUM Published 2019-05-23 Modified 2020-08-31 Official page ↗
Ecosystem
npm
Packages
generate-password
Severity
Moderate
Weaknesses
CWE-338
Reviewed
2019-05-23

Affected packages

• npm generate-password: < 1.4.1 → fixed in 1.4.1

Description

Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords. Recommendation Update to version 1.4.1 or later.

Related

Weakness · CWE (1)

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References