GHSA-m9m5-cg5h-r582MediumCVSS 5.1

Improper random number generation in nanorand

Published
August 25, 2021
Last Modified
June 13, 2023

🔗 CVE IDs covered (1)

📋 Description

In versions of nanorand prior to 0.5.1, RandomGen implementations for standard unsigned integers could fail to properly generate numbers, due to using bit-shifting to truncate a 64-bit number, rather than just an as conversion. This often manifested as RNGs returning nothing but 0, including the cryptographically secure ChaCha random number generator.

🎯 Affected products1

  • rust/nanorand:< 0.5.1

🔗 References (5)