Skip to content

Cryptographically Weak PRNG in randomatic

Moderate severity GitHub Reviewed Published Oct 9, 2018 to the GitHub Advisory Database • Updated Sep 8, 2023

Package

npm randomatic (npm)

Affected versions

< 3.0.0

Patched versions

3.0.0

Description

Affected versions of randomatic generate random values using a cryptographically weak psuedo-random number generator. This may result in predictable values instead of random values as intended.

Recommendation

Update to version 3.0.0 or later.

References

Published to the GitHub Advisory Database Oct 9, 2018
Reviewed Jun 16, 2020
Last updated Sep 8, 2023

Severity

Moderate
5.3
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVE ID

CVE-2017-16028

GHSA ID

GHSA-6g33-f262-xjp4

Source code

No known source code
Checking history
See something to contribute? Suggest improvements for this vulnerability.