CWE-331: Insufficient Entropy
Base
The product uses an algorithm or scheme that produces insufficient entropy, leaving patterns or clusters of values that are more likely to occur than others.
Consequences
- Access Control, Other: Bypass Protection Mechanism, Other
How to prevent it
- Implementation: Determine the necessary entropy to adequately provide for randomness and predictability. This can be achieved by increasing the number of bits of objects such as keys and seeds.
Recent advisories
- GHSA-p5jq-5383-qvc7 — TYPO3 CMS uses insufficient entropy when generating passwords
- GHSA-848f-mph5-9pm9 — Zendframework Potential Information Disclosure and Insufficient Entropy vulnerability
- GHSA-8xhv-gqm4-3w99 — ZendFramework1 Potential Insufficient Entropy Vulnerability
- GHSA-wqcc-qf63-c2x4 — WWBN AVideo Insufficient Entropy vulnerbaility
- GHSA-5844-q3fc-56rh — pubnub Insufficient Entropy vulnerability
- GHSA-8c69-r38j-rpfj — Rancher cattle-token is predictable
- GHSA-2m7h-86qq-fp4v — Insecure entropy in Argo CD's PKCE/Oauth2/OIDC params
- GHSA-w8cc-3h7q-jhc3 — Mattermost Server has low entropy for authorization data as an OAuth 2.0 Service Provider
- GHSA-rmw5-xpg9-jr29 — Use of Cryptographically Weak Pseudo-Random Number Generator in Rclone
- GHSA-x345-32rc-8h85 — Denial of service attack via push rule patterns in matrix-synapse
- GHSA-pf46-gqg9-j3v3 — Insufficient Entropy in DotNetNuke
- GHSA-xx3h-j3cx-8qfj — Insufficient Entropy in DotNetNuke
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor