Description
Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.
Remediation
References
https://github.com/hapijs/cryptiles/issues/34
https://github.com/hapijs/cryptiles/issues/35
Related Vulnerabilities
CVE-2021-45851 Vulnerability in npm package @frangoteam/fuxa
CVE-2020-26237 Vulnerability in maven package org.webjars.bowergithub.highlightjs:highlight.js
CVE-2021-23362 Vulnerability in npm package hosted-git-info
CVE-2022-0122 Vulnerability in npm package node-forge
CVE-2023-38509 Vulnerability in maven package org.xwiki.platform:xwiki-platform-livetable-ui