Insecure PRNG use in random_password_generator

ALTO 7.5CVE-2019-25061 · GHSA-ggfx-h9xj-5v9c · Published 18/05/2022 · updated 17/06/2026

In breve

CVE-2019-25061 è una vulnerabilità ALTO (CVSS 7.5) che riguarda random_password_generator, random password generator (random password generator project).
Probabilità di sfruttamento nei prossimi 30 giorni (EPSS): 1.9%, superiore al 79.8% delle vulnerabilità.
Nessuna versione corretta ancora nota: segui l'avviso del produttore nei riferimenti.

Package	Affected versions	Patched versions
random_password_generator RubyGems	`≤ 1.0.0`	No fix yet
random password generator random_password_generator_project	`≤ 1.0.0`	No fix yet

Description

The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.

NVD description

The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.

References

nvd.nist.gov/vuln/detail/CVE-2019-25061 · ADVISORY
bvsatyaram/random_password_generator#1 · WEB
bvsatyaram/random_password_generator · PACKAGE
bvsatyaram/random_password_generator · WEB
rubysec/ruby-advisory-db · WEB
ruby-doc.org/core-3.1.2/Random.html · WEB
stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-other-methods/42170560 · WEB

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free