Insecure PRNG use in random_password_generator
Published: May 19, 2022
SECURITY IDENTIFIERS
- CVE: CVE-2019-25061 (NVD)
- GHSA: GHSA-ggfx-h9xj-5v9c
- Vendor Advisory: https://github.com/bvsatyaram/random_password_generator/pull/1
GEM
SEVERITY
CVSS v3.x: 7.5 (High)
PATCHED VERSIONS
None available.
DESCRIPTION
The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.