Rust · Nanorand · CVE-2020-35926
**Name of the Vulnerable Software and Affected Versions**
nanorand versions prior to 0.5.1
**Description**
An issue in the nanorand crate caused random number generators, including the cryptographically secure ChaCha, to return all zeroes due to mishandled integer truncation. This occurred because the implementation used bit-shifting to truncate a 64-bit number instead of an `as` conversion, leading to improper number generation.
**Recommendations**
For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of random number generators that rely on the affected `RandomGen` implementations until a patch is available.