paragonie/random_compat · Security
random_compat Uses insecure CSPRNG
- GHSA ID
- GHSA-3fmq-x9q6-wm39
- Severity
- low
- Published
- Updated
Description
random_compat versions prior to 2.0 are affected by a security vulnerability related to the insecure usage of Cryptographically Secure Pseudo-Random Number Generators (CSPRNG). The affected versions use openssl_random_pseudo_bytes(), which may result in insufficient entropy and compromise the security of generated random numbers.
CWEs
- CWE-331 · Insufficient Entropy