Insecure Randomness

2023-05-1209:49:58

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

github

cloudflare

circl

vulnerability

insecure randomness

kyber

frodokem

shared secret

tkn20

blindrsa

predictable

deployment cases

EPSS

0.001

Percentile

19.4%

JSON

github.com/cloudflare/circl is vulnerable to Insecure Randomness. Kyber and FrodoKEM did not check whether crypto/rand.Read() returned an error, leading to a predictable shared secret. The tkn20 and blindrsa components did not check if enough randomness was returned from the user provided randomness source. In rare deployment cases, this could lead to a predictable shared secret.