Lucene search

RubySecRUBY:RANDOM_PASSWORD_GENERATOR-2019-25061

HistoryMay 18, 2022 - 9:00 p.m.

Insecure PRNG use in random_password_generator

2022-05-1821:00:00

RubySec

github.com

prng

random_password_generator

insecurity

prediction

ruby

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

JSON

The random_password_generator (aka RandomPasswordGenerator) gem through
1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic
nature, can facilitate password prediction.

References

github.com/bvsatyaram/random_password_generator/pull/1

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

JSON

Related for RUBY:RANDOM_PASSWORD_GENERATOR-2019-25061