~ / search / GHSA-m9m5-cg5h-r582

GHSA-m9m5-cg5h-r582

Improper random number generation in nanorand

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-35926

Packages

EcosystemPackageAffectedFixed in
crates.io nanorand < 0.5.1 0.5.1

Details

As written in the advisory (Markdown source, shown as plain text).

In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the cryptographically secure ChaCha random number generator.

References

External links from the advisory. They lead to third-party sites.