randomatic

[srepollock]

Remediation

Upgrade randomatic to version 3.0.0 or later. For example:

"dependencies": {
"randomatic": ">=3.0.0"
}
or…
"devDependencies": {
"randomatic": ">=3.0.0"
}
Always verify the validity and compatibility of suggestions with your codebase.

Details

CVE-2017-16028 More information
low severity
Vulnerable versions: < 3.0.0
Patched version: 3.0.0
react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).

[srepollock]

This issue has been addressed and closed in release v1.0.1

Thank you for the help 🐼