Improper random number generation in nanorand
In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the cryptographically secure ChaCha random number generator.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-35926US | critical9.8OT erhöht | — | ||
An issue was discovered in the nanorand crate before 0.5.1 for Rust. It caused any random number generator (even ChaCha) to return all zeroes because integer truncation was mishand… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://github.com/Absolucy/nanorand-rsPACKAGE
- https://github.com/Absolucy/nanorand-rs/commit/5ba218ac29df4786b002d7d12b47fa0c04a331f2WEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-35926ADVISORY
- https://rustsec.org/advisories/RUSTSEC-2020-0089.htmlWEB
- https://twitter.com/aspenluxxxy/status/1336684692284772352WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan