Same Seed in Pseudo-Random Number Generator (PRNG)
CWE-336
The product uses a Pseudo-Random Number Generator (PRNG) that uses the same seed each time the product is initialized.
We track 2 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9.
How this weakness is prevented
- Architecture and Design: Do not reuse PRNG seeds. Consider a PRNG that periodically re-seeds itself as needed from a high quality pseudo-random output, such as hardware devices.
- Architecture and Design Requirements: Use products or modules that conform to FIPS 140-2 to avoid obvious entropy problems, or use the more recent FIPS 140-3 if possible.
Latest Same Seed in Pseudo-Random Number Generator (PRNG) vulnerabilities
- 8.7 High severity
Silicon Labs Matter Github: Same Seed in Pseudo-Random Number Generator (PRNG)
A bug in the entropy initialization for SiWx917 causes the DRBG to use a predictable seed. As such, all random numbers generated in the Matter code use the same stream of numbers. This vulnerability was discovered after the impacted repository was already depr
- 9.2 Critical severity
ess-helm: Same Seed in Pseudo-Random Number Generator (PRNG)
Element Server Suite Community Edition (ESS Community) deploys a Matrix stack using the provided Helm charts and Kubernetes distribution. The ESS Community Helm Chart secrets initialization hook (using matrix-tools container before 0.5.7) is using an insecure