You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Standard random number generators do not provide a sufficient amount of entropy when used for security purposes.
Attackers can brute force the output of pseudorandom number generators such as rand().
If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead.
These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL.
In Java, use the SecureRandom object to ensure sufficient entropy.
This issue is NOT closed with a proper Reason/ label. Make sure to add proper reason label before closing. Please add or leave a comment with the proper reason label now.
- Reason/EngineeringMistake - The issue occurred due to a mistake made in the past. - Reason/Regression - The issue has introduced a regression. - Reason/MultipleComponentInteraction - Issue occured due to interactions in multiple components. - Reason/Complex - Issue occurred due to complex scenario. - Reason/Invalid - Issue is invalid. - Reason/Other - None of the above cases.
Description:
Standard random number generators do not provide a sufficient amount of entropy when used for security purposes.
Attackers can brute force the output of pseudorandom number generators such as rand().
If this random number is used where security is a concern, such as generating a session key or session identifier, use a trusted cryptographic random number generator instead.
These can be found on the Windows platform in the CryptoAPI or in an open source library such as OpenSSL.
In Java, use the SecureRandom object to ensure sufficient entropy.
References:
CWE (https://cwe.mitre.org/data/definitions/331.html)
Affected Versions:
Ballerina 1.2.x
Related Issues (optional):
#2876
The text was updated successfully, but these errors were encountered: