Skip to content
OpenAdvisories

Weakness (CWE)

CWE-336: Same Seed in Pseudo-Random Number Generator (PRNG)

Variant Draft

The product uses a Pseudo-Random Number Generator (PRNG) that uses the same seed each time the product is initialized.

How to prevent it (2 mitigations)

  1. Architecture and Design

    Do not reuse PRNG seeds. Consider a PRNG that periodically re-seeds itself as needed from a high quality pseudo-random output, such as hardware devices.

  2. Architecture and Design, Requirements

    Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems, or use the more recent FIPS 140-3 [REF-1192] if possible.

Source: MITRE CWE-336

All Critical High Medium Low Exploited only Public exploit

0 results · Clear filters · Feed

Nothing found.