Cryptographically Weak PRNG in generate-password

Description

Affected versions of generate-password generate random values that are biased towards certain characters depending on the chosen character sets. This may result in guessable passwords.

Recommendation

Update the generate-password package to the latest compatible version. Followings are version details:

• Affected version(s): < 1.4.1
• Patched version(s): 1.4.1

References

• GHSA-6qqf-vvcr-7qrv
• www.npmjs.com
• CWE-338
• OWASP 2021-A2

Related Issues

• Redwood is vulnerable to account takeover via dbAuth "forgot-password - Vulnerability
• Storing Password in Local Storage - Vulnerability
• CouchAuth host header injection vulnerability leaks the password reset token - CVE-2023-39655
• Weak Password - Vulnerability

You might also like:

How do hackers hack websites?

5 Security Vulnerabilities You Can Fix Right Now

Update Cheat Sheet for Developers

Tags:

npm

generate-password