PT-2022-8283 · Ruby · Random Password Generator

Jodawill · Published 2022-05-18 · Updated 2022-05-26 · CVE-2019-25061

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions random password generator gem versions through 1.0.0

Description The issue concerns the use of Kernel#rand to generate passwords, which has a cyclic nature that can facilitate password prediction. This affects the random password generator gem for Ruby.

Recommendations For versions through 1.0.0, consider using an alternative method for password generation that does not rely on Kernel#rand to minimize the risk of password prediction. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use of Insufficiently Random Values

Weakness Enumeration

CWE-335

CWE-330

Related Identifiers

CVE-2019-25061

GHSA-GGFX-H9XJ-5V9C

Affected Products

Random Password Generator

References · 10

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/random_password_generator/CVE-2019-25061.yml · Exploit
• 🔥 https://stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-other-methods/42170560 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-25061 · Security Note
• https://osv.dev/vulnerability/CVE-2019-25061 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ggfx-h9xj-5v9c · Vendor Advisory
• https://github.com/bvsatyaram/random_password_generator · Note
• https://github.com/bvsatyaram/random_password_generator/blob/2855e8d7d8803dbb580ddd6cf13846394eb4530e/lib/random_password_generator.rb#L23 · Note
• https://github.com/bvsatyaram/random_password_generator/pull/1 · Note
• https://ruby-doc.org/core-3.1.2/Random.html · Note
• https://t.me/cibsecurity/42888 · Telegram Post