Vulnerability Details : CVE-2019-25061
The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.
Products affected by CVE-2019-25061
- Random Password Generator Project » Random Password Generator » For RubyVersions up to, including, (<=) 1.0.0cpe:2.3:a:random_password_generator_project:random_password_generator:*:*:*:*:*:ruby:*:*
Exploit prediction scoring system (EPSS) score for CVE-2019-25061
0.22%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 60 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2019-25061
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
5.0
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:N/A:N |
10.0
|
2.9
|
NIST | |
|
7.5
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N |
3.9
|
3.6
|
NIST |
CWE ids for CVE-2019-25061
-
The product uses a Pseudo-Random Number Generator (PRNG) but does not correctly manage seeds.Assigned by: nvd@nist.gov (Primary)
References for CVE-2019-25061
-
https://github.com/bvsatyaram/random_password_generator/pull/1
Use SecureRandom by jodawill · Pull Request #1 · bvsatyaram/random_password_generator · GitHubIssue Tracking;Third Party Advisory
-
https://github.com/bvsatyaram/random_password_generator/blob/2855e8d7d8803dbb580ddd6cf13846394eb4530e/lib/random_password_generator.rb#L23
random_password_generator/random_password_generator.rb at 2855e8d7d8803dbb580ddd6cf13846394eb4530e · bvsatyaram/random_password_generator · GitHubThird Party Advisory
-
https://stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-other-methods/42170560
Security of rand in ruby compared to other methods - Stack OverflowExploit;Third Party Advisory
-
https://ruby-doc.org/core-3.1.2/Random.html
Class: Random (Ruby 3.1.2)Third Party Advisory
Jump to