Skip to content
Log inStart free trial

CWE-341: Predictable from Observable State

Base

A number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.

Consequences

  • Other: Varies by Context

How to prevent it

  • Implementation: Increase the entropy used to seed a PRNG.
  • Architecture and Design, Requirements: Use products or modules that conform to FIPS 140-2 [REF-267] to avoid obvious entropy problems. Consult FIPS 140-2 Annex C ("Approved Random Number Generators").
  • Implementation: Use a PRNG that periodically re-seeds itself using input from high-quality sources, such as hardware devices with high entropy. However, do not re-seed too frequently, or else the entropy source might block.

Recent advisories

All advisories for CWE-341

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor