NVD Vulnerability Detail

CVE-2019-25061

Summary	The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.
Publication Date	May 18, 2022, 8:15 p.m.
Registration Date	May 19, 2022, 10 a.m.
Last Update	Nov. 21, 2024, 1:39 p.m.

Affected software configurations

Configuration1		or higher	or less	more than	less than
cpe:2.3:a:random_password_generator_project:random_password_generator::::::ruby::*			1.0.0

Related information, measures and tools

No	URL	タグ
1	https://github.com/bvsatyaram/random_password_generator/blob/2855e8d7d8803dbb580ddd6cf13846394eb4530e/lib/random_password_generator.rb#L23	Third Party Advisory
2	https://github.com/bvsatyaram/random_password_generator/blob/2855e8d7d8803dbb580ddd6cf13846394eb4530e/lib/random_password_generator.rb#L23	Third Party Advisory
3	https://github.com/bvsatyaram/random_password_generator/pull/1	Issue Tracking Third Party Advisory
4	https://github.com/bvsatyaram/random_password_generator/pull/1	Issue Tracking Third Party Advisory
5	https://ruby-doc.org/core-3.1.2/Random.html	Third Party Advisory
6	https://ruby-doc.org/core-3.1.2/Random.html	Third Party Advisory
7	https://stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-other-methods/42170560	Exploit Third Party Advisory
8	https://stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-other-methods/42170560	Exploit Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-335	PRNGにおけるシードの不正な使用	https://cwe.mitre.org/data/definitions/335.html

JVN Vulnerability Information

random password generator project の Ruby 用 random password generator における PRNG におけるシードの不正な使用に関する脆弱性

Title	random password generator project の Ruby 用 random password generator における PRNG におけるシードの不正な使用に関する脆弱性
Summary	random password generator project の Ruby 用 random password generator には、PRNG におけるシードの不正な使用に関する脆弱性が存在します。
Possible impacts	情報を取得される可能性があります。
Solution	参考情報を参照して適切な対策を実施してください。
Publication Date	May 18, 2022, midnight
Registration Date	Aug. 9, 2023, 5:17 p.m.
Last Update	Aug. 9, 2023, 5:17 p.m.

Affected System

random password generator project

random password generator 1.0.0 およびそれ以前

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-25061	https://www.cve.org/CVERecord?id=CVE-2019-25061
National Vulnerability Database (NVD)
2	CVE-2019-25061	https://nvd.nist.gov/vuln/detail/CVE-2019-25061

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-335	https://cwe.mitre.org/data/definitions/335.html

その他

No	Name	URL
関連文書
1	github.com (pull/1)	https://github.com/bvsatyaram/random_password_generator/pull/1
2	github.com (random_password_generator.rb#L23)	https://github.com/bvsatyaram/random_password_generator/blob/2855e8d7d8803dbb580ddd6cf13846394eb4530e/lib/random_password_generator.rb#L23
3	ruby-doc.org (Random)	https://ruby-doc.org/core-3.1.2/Random.html
4	stackoverflow.com (security-of-rand-in-ruby-compared-to-other-methods/42170560)	https://stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-other-methods/42170560

Change Log

No	Changed Details	Date of change
1	[2023年08月09日] 掲載	Aug. 9, 2023, 5:17 p.m.