CVE-2017-16028 Cryptographically Weak PRNG in randomatic
MediumCVSS 5.3
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
react-native-meteor-oauth is a library for Oauth2 login to a Meteor server in React Native. The oauth Random Token is generated using a non-cryptographically strong RNG (Math.random()).
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| npm randomatic(npm) | < 3.0.0 | 3.0.0 |
| randomatic project randomatic | < 3.0.0 | 3.0.0 |
| HackerOne react-native-meteor-oauth node module | = All versions | No fix listed |
References
- nvd.nist.gov third-party-advisory
- github.com patch
- github.com
- www.npmjs.com
- github.com third-party-advisory
- nodesecurity.io patch third-party-advisory