CWE-338
AllowedUse of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Abstraction: Base · Status: Draft
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.
308 vulnerabilities reference this CWE, most recent first.
GHSA-W88F-4875-99C8
Vulnerability from github – Published: 2025-11-26 09:31 – Updated: 2025-11-26 23:19Apache Druid’s Kerberos authenticator uses a weak fallback secret when the druid.auth.authenticator.kerberos.cookieSignatureSecret configuration is not explicitly set. In this case, the secret is generated using ThreadLocalRandom, which is not a crypto-graphically secure random number generator. This may allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Additionally, each process generates its own fallback secret, resulting in inconsistent secrets across nodes. This causes authentication failures in distributed or multi-broker deployments, effectively leading to a incorrectly configured clusters. Users are advised to configure a strong druid.auth.authenticator.kerberos.cookieSignatureSecret
This issue affects Apache Druid: through 34.0.0.
Users are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set druid.auth.authenticator.kerberos.cookieSignatureSecret when using the Kerberos authenticator. Services will fail to come up if the secret is not set.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.druid:druid"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "35.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-59390"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": true,
"github_reviewed_at": "2025-11-26T23:19:18Z",
"nvd_published_at": "2025-11-26T09:15:46Z",
"severity": "CRITICAL"
},
"details": "Apache Druid\u2019s Kerberos authenticator uses a weak fallback secret when the `druid.auth.authenticator.kerberos.cookieSignatureSecret` configuration is not explicitly set. In this case, the secret is generated using `ThreadLocalRandom`, which is not a crypto-graphically secure random number generator. This may allow an attacker to predict or brute force the secret used to sign authentication cookies, potentially enabling token forgery or authentication bypass. Additionally, each process generates its own fallback secret, resulting in inconsistent secrets across nodes. This causes authentication failures in distributed or multi-broker deployments, effectively leading to a incorrectly configured clusters. Users are advised to configure a strong\u00a0`druid.auth.authenticator.kerberos.cookieSignatureSecret`\n\nThis issue affects Apache Druid: through 34.0.0.\n\nUsers are recommended to upgrade to version 35.0.0, which fixes the issue making it mandatory to set `druid.auth.authenticator.kerberos.cookieSignatureSecret` when using the\u00a0Kerberos authenticator. Services will fail to come up if the secret is not set.",
"id": "GHSA-w88f-4875-99c8",
"modified": "2025-11-26T23:19:18Z",
"published": "2025-11-26T09:31:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59390"
},
{
"type": "WEB",
"url": "https://github.com/apache/druid/pull/18368"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/druid"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/jwjltllnntgj1sb9wzsjmvwm9f8rlhg8"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2025/11/26/1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Apache Druid\u2019s Kerberos authenticator uses a weak fallback secret"
}
GHSA-WCW3-C785-7Q5X
Vulnerability from github – Published: 2025-12-22 15:30 – Updated: 2025-12-22 15:30Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.
{
"affected": [],
"aliases": [
"CVE-2025-26379"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-22T15:16:00Z",
"severity": "HIGH"
},
"details": "Use of a weak pseudo-random number generator, which may allow an attacker to read or inject encrypted PowerG packets.",
"id": "GHSA-wcw3-c785-7q5x",
"modified": "2025-12-22T15:30:21Z",
"published": "2025-12-22T15:30:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26379"
},
{
"type": "WEB",
"url": "https://www.cisa.gov/news-events/ics-advisories/icsa-25-350-02"
},
{
"type": "WEB",
"url": "https://www.johnsoncontrols.com/trust-center/cybersecurity/security-advisories"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-WR3G-2HMF-PGF3
Vulnerability from github – Published: 2022-05-24 17:12 – Updated: 2022-05-24 17:12An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by use of the 8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR private key and the r)fddEw232f encryption key.
{
"affected": [],
"aliases": [
"CVE-2019-15075"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-03-20T18:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in iNextrix ASTPP before 4.0.1. web_interface/astpp/application/config/config.php does not have strong random keys, as demonstrated by use of the 8YSDaBtDHAB3EQkxPAyTz2I5DttzA9uR private key and the r)fddEw232f encryption key.",
"id": "GHSA-wr3g-2hmf-pgf3",
"modified": "2022-05-24T17:12:00Z",
"published": "2022-05-24T17:12:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-15075"
},
{
"type": "WEB",
"url": "https://github.com/iNextrix/ASTPP/commit/9877ec62556f0470030acd306b24bc94fdcbe2ae"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-WWVV-X5MQ-H3JJ
Vulnerability from github – Published: 2021-09-01 18:35 – Updated: 2021-08-30 20:28yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "yiisoft/yii2-dev"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.0.43"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-3692"
],
"database_specific": {
"cwe_ids": [
"CWE-330",
"CWE-338"
],
"github_reviewed": true,
"github_reviewed_at": "2021-08-30T20:28:42Z",
"nvd_published_at": "2021-08-10T17:15:00Z",
"severity": "MODERATE"
},
"details": "yii2 is vulnerable to Use of Predictable Algorithm in Random Number Generator",
"id": "GHSA-wwvv-x5mq-h3jj",
"modified": "2021-08-30T20:28:42Z",
"published": "2021-09-01T18:35:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-3692"
},
{
"type": "WEB",
"url": "https://github.com/yiisoft/yii2/commit/13f27e4d920a05d53236139e8b07007acd046a46"
},
{
"type": "PACKAGE",
"url": "https://github.com/yiisoft/yii2"
},
{
"type": "WEB",
"url": "https://huntr.dev/bounties/55517f19-5c28-4db2-8b00-f78f841e8aba"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Use of Cryptographically Weak Pseudo-Random Number Generator in yiisoft/yii2-dev"
}
GHSA-X97H-G784-4PW8
Vulnerability from github – Published: 2025-04-10 12:31 – Updated: 2025-04-10 15:31In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.
{
"affected": [],
"aliases": [
"CVE-2025-32754"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-10T12:15:16Z",
"severity": "CRITICAL"
},
"details": "In jenkins/ssh-agent Docker images 6.11.1 and earlier, SSH host keys are generated on image creation for images based on Debian, causing all containers based on images of the same version use the same SSH host keys, allowing attackers able to insert themselves into the network path between the SSH client (typically the Jenkins controller) and SSH build agent to impersonate the latter.",
"id": "GHSA-x97h-g784-4pw8",
"modified": "2025-04-10T15:31:48Z",
"published": "2025-04-10T12:31:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-32754"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2025-04-10/#SECURITY-3565"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XHP6-Q4JG-8VP6
Vulnerability from github – Published: 2023-06-19 18:30 – Updated: 2024-04-04 04:57A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios. This issue was observed for use of the following versions of Democracy Suite: 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15. NOTE: the Democracy Suite 5.17 EAC Certificate of Conformance mentions "Improved pseudo random number algorithm," which may be relevant.
{
"affected": [],
"aliases": [
"CVE-2022-48506"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-06-19T16:15:09Z",
"severity": "LOW"
},
"details": "A flawed pseudorandom number generator in Dominion Voting Systems ImageCast Precinct (ICP and ICP2) and ImageCast Evolution (ICE) scanners allows anyone to determine the order in which ballots were cast from public ballot-level data, allowing deanonymization of voted ballots, in several types of scenarios. This issue was observed for use of the following versions of Democracy Suite: 5.2, 5.4-NM, 5.5, 5.5-A, 5.5-B, 5.5-C, 5.5-D, 5.7-A, 5.10, 5.10A, 5.15. NOTE: the Democracy Suite 5.17 EAC Certificate of Conformance mentions \"Improved pseudo random number algorithm,\" which may be relevant.",
"id": "GHSA-xhp6-q4jg-8vp6",
"modified": "2024-04-04T04:57:18Z",
"published": "2023-06-19T18:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48506"
},
{
"type": "WEB",
"url": "https://dvsorder.org"
},
{
"type": "WEB",
"url": "https://freedom-to-tinker.com/2023/06/14/security-analysis-of-the-dominion-imagecast-x"
},
{
"type": "WEB",
"url": "https://www.eac.gov/sites/default/files/voting_system/files/D-Suite%205.17%20Certificate%20and%20Scope%20SIGNED.pdf"
},
{
"type": "WEB",
"url": "https://www.eac.gov/voting-equipment/democracy-suite-517"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XPFQ-7J72-X4PX
Vulnerability from github – Published: 2025-04-13 00:30 – Updated: 2025-09-05 15:31Crypt::CBC versions between 1.21 and 3.04 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.
This issue affects operating systems where "/dev/urandom'" is unavailable. In that case, Crypt::CBC will fallback to use the insecure rand() function.
{
"affected": [],
"aliases": [
"CVE-2025-2814"
],
"database_specific": {
"cwe_ids": [
"CWE-329",
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-13T00:15:14Z",
"severity": "MODERATE"
},
"details": "Crypt::CBC versions between 1.21 and 3.04 for Perl may use the rand() function as the default source of entropy, which is not cryptographically secure, for cryptographic functions.\n\nThis issue affects operating systems where \"/dev/urandom\u0027\" is unavailable.\u00a0 In that case, Crypt::CBC will fallback to use the insecure rand() function.",
"id": "GHSA-xpfq-7j72-x4px",
"modified": "2025-09-05T15:31:06Z",
"published": "2025-04-13T00:30:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-2814"
},
{
"type": "WEB",
"url": "https://github.com/lstein/Lib-Crypt-CBC/commit/37111f7cd894bcec46156ba7f40a49c126ebf535.patch"
},
{
"type": "WEB",
"url": "https://metacpan.org/dist/Crypt-CBC/source/lib/Crypt/CBC.pm#L777"
},
{
"type": "WEB",
"url": "https://perldoc.perl.org/functions/rand"
},
{
"type": "WEB",
"url": "https://security.metacpan.org/docs/guides/random-data-for-security.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XXRM-3F86-V97J
Vulnerability from github – Published: 2026-07-13 18:30 – Updated: 2026-07-13 18:30Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator's state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.
{
"affected": [],
"aliases": [
"CVE-2026-61500"
],
"database_specific": {
"cwe_ids": [
"CWE-338"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-13T18:16:29Z",
"severity": "CRITICAL"
},
"details": "Rejetto HFS 3.0.0 through 3.2.0 derives its session-cookie signing key from the non-cryptographic Math.random() generator and discloses outputs of the same generator to unauthenticated clients during login. A remote attacker can collect a small number of login responses, reconstruct the generator\u0027s state, recover the signing key, and forge a valid administrator session cookie, leading to full administrative access and remote code execution via the server_code configuration feature.",
"id": "GHSA-xxrm-3f86-v97j",
"modified": "2026-07-13T18:30:54Z",
"published": "2026-07-13T18:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61500"
},
{
"type": "WEB",
"url": "https://github.com/rejetto/hfs/releases/tag/v3.2.1"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/rejetto-hfs-session-forgery-via-predictable-signing-key"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
Use functions or hardware which use a hardware-based random number generation for all crypto. This is the recommended solution. Use CyptGenRandom on Windows, or hw_rand() on Linux.
No CAPEC attack patterns related to this CWE.