Weakness (CWE)
CWE-331: Insufficient Entropy
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
How to prevent it (1 mitigation)
-
Implementation
Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.
Source: MITRE CWE-331
124 results · Feed
-
Critical 9.8
Insufficient Entropy in cryptiles
Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear t…
-
Unscored —
An Insufficient Entropy issue was discovered in LOYTEC LVIS-3ME versions prior to 6.2.0. The application does not utili…
-
High 7.5
Lemur uses static IV per key
Lemur 0.1.4 does not use sufficient entropy in its IV when encrypting AES in CBC mode.
-
High 7.6
Post Oak Bluetooth Traffic Systems Insufficient Entropy
Post Oak AWAM Bluetooth Reader Traffic System does not use a sufficient source of entropy for private keys, which makes it easier for man-in-the-middle attackers to spoof a device by predicting a key value.