Description
The random_password_generator (aka RandomPasswordGenerator) gem through 1.0.0 for Ruby uses Kernel#rand to generate passwords, which, due to its cyclic nature, can facilitate password prediction.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
n/a n/a
n/aaffected
References
- https://github.com/bvsatyaram/random_password_generator/blob/2855e8d7d8803dbb580ddd6cf13846394eb4530e/lib/random_password_generator.rb#L23 ↗
- https://ruby-doc.org/core-3.1.2/Random.html ↗
- https://stackoverflow.com/questions/42170239/security-of-rand-in-ruby-compared-to-other-methods/42170560 ↗
- https://github.com/bvsatyaram/random_password_generator/pull/1 ↗