GHSA-3fmq-x9q6-wm39: random_compat Uses insecure CSPRNG

May 17, 2024

random_compat versions prior to 2.0 are affected by a security vulnerability related to the insecure usage of Cryptographically Secure Pseudo-Random Number Generators (CSPRNG). The affected versions use openssl_random_pseudo_bytes(), which may result in insufficient entropy and compromise the security of generated random numbers.

References

github.com/FriendsOfPHP/security-advisories/blob/master/paragonie/random_compat/2016-03-16.yaml
github.com/advisories/GHSA-3fmq-x9q6-wm39
github.com/paragonie/random_compat
github.com/paragonie/random_compat/issues/96

Code Behaviors & Features

Detect and mitigate GHSA-3fmq-x9q6-wm39 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →