Cryptographically Weak PRNG in generate-password
Summary
GHSA-6qqf-vvcr-7qrv: Cryptographically Weak PRNG in generate-password. Affects generate-password versions < 1.4.1. Fixed in 1.4.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The generate-password package is an npm package that is used to generate random passwords. It provides a simple and convenient way to generate passwords with various character sets and lengths. However, certain versions of generate-password suffer from a vulnerability that results in the generation of biased passwords, making them easier to guess.
Vulnerability Detail
The vulnerability in generate-password arises from the use of a cryptographically weak pseudorandom number generator (PRNG) to generate random values. This PRNG is biased towards certain characters depending on the chosen character sets, leading to the creation of passwords that are more predictable and easier to guess. This vulnerability poses a risk to the security of systems and accounts that rely on passwords generated by generate-password.
How To Fix
Minimum fixed version
1.4.1
This is the first release that contains the fix.
npm install generate-password@1.4.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. The recommended solution is to update the generate-password package to the latest version.
Conclusion
The generate-password package suffers from a vulnerability that results in the generation of biased passwords. To mitigate this issue, it is crucial to update the package to version 1.4.1 or later. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for generate-password →
FAQ
generate-password is an npm package that provides a simple way to generate random passwords with different character sets and lengths.
The vulnerability in generate-password results in the generation of biased passwords, making them easier to guess. This can compromise the security of systems and accounts that rely on passwords generated by generate-password.
To fix this vulnerability, update the generate-password package to version 1.4.1 or later.
There are no specific workarounds mentioned for this vulnerability. Updating the generate-password package to the latest version is the recommended solution.
You can find more information about this vulnerability in the GitHub Security Advisory database. The vulnerability ID is GHSA-6qqf-vvcr-7qrv.
