GHSA-6qqf-vvcr-7qrv Cryptographically Weak PRNG in generate-password
Weak random number generation in generate-password creates biased, guessable passwords, allowing attackers to bypass authentication.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-6qqf-vvcr-7qrv?
GHSA-6qqf-vvcr-7qrv is a vulnerability in generate-password, published on 23 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords.
Recommendation
Update to version 1.4.1 or later.
Which versions are affected by GHSA-6qqf-vvcr-7qrv?
2 open source packages ship an affected version, including generate-password.
| Package | Affected | Fixed in |
|---|---|---|
generate-password npm | All versions | 1.4.1 |
generate-password npm | All versions | 1.4.1 |
How do I fix GHSA-6qqf-vvcr-7qrv?
Upgrade generate-password to 1.4.1 or later.
Is GHSA-6qqf-vvcr-7qrv being exploited?
There is no known exploitation of GHSA-6qqf-vvcr-7qrv in the wild and no public exploit code.