Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix security vulnerabilities reported on math module with 1.2.x #4367

Closed
madhukaw opened this issue Apr 20, 2023 · 2 comments
Closed

Fix security vulnerabilities reported on math module with 1.2.x #4367

madhukaw opened this issue Apr 20, 2023 · 2 comments

Comments

@madhukaw
Copy link
Contributor

madhukaw commented Apr 20, 2023

Description:

Standard random number generators do not provide a sufficient amount of entropy when used for security purposes.
Attackers can brute force the output of pseudorandom number generators such as rand().

If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead.
These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL.
In Java, use the SecureRandom object to ensure sufficient entropy.

References:
CWE (https://cwe.mitre.org/data/definitions/331.html)

Affected Versions:
Ballerina 1.2.x

Related Issues (optional):

#2876

@madhukaw
Copy link
Contributor Author

Closing since completed.

@github-actions
Copy link

This issue is NOT closed with a proper Reason/ label. Make sure to add proper reason label before closing. Please add or leave a comment with the proper reason label now.

      - Reason/EngineeringMistake - The issue occurred due to a mistake made in the past.
      - Reason/Regression - The issue has introduced a regression.
      - Reason/MultipleComponentInteraction - Issue occured due to interactions in multiple components.
      - Reason/Complex - Issue occurred due to complex scenario.
      - Reason/Invalid - Issue is invalid.
      - Reason/Other - None of the above cases.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Archived in project
Development

No branches or pull requests

1 participant