GitHub Advisoryadvisory · crates.io

GHSA-m9m5-cg5h-r582 Improper random number generation in nanorand

MEDIUM Published 2021-08-25 Modified 2023-06-13 Official page ↗
Aliases
CVE-2020-35926
Ecosystem
crates.io
Packages
nanorand
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weaknesses
CWE-338
Reviewed
2021-08-19

Affected packages

• crates.io nanorand: < 0.5.1 → fixed in 0.5.1

Description

In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the cryptographically secure ChaCha random number generator.

Related

Alias · CVE (1)

  • CVE-2020-35926 An issue was discovered in the nanorand crate before 0.5.1 for Rust. vulnerability

Weakness · CWE (1)

  • CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness

References