GoUtils's randomly-generated alphanumeric strings contain significantly less entropy than expected
Critical severity
GitHub Reviewed
Published
Dec 28, 2022
to the GitHub Advisory Database
•
Updated May 20, 2024
Package
Affected versions
< 1.1.1
Patched versions
1.1.1
Description
Published by the National Vulnerability Database
Dec 27, 2022
Published to the GitHub Advisory Database
Dec 28, 2022
Reviewed
Dec 30, 2022
Last updated
May 20, 2024
Randomly-generated alphanumeric strings contain significantly less entropy than expected. The
RandomAlphaNumeric
andCryptoRandomAlphaNumeric
functions always return strings containing at least one digit from 0 to 9. This significantly reduces the amount of entropy in short strings generated by these functions.References