Insufficient Entropy

Overview

Versions of cryptiles from version 3.1.0 through 3.1.2, and versions 4.0.0 to version 4.1.1 are vulnerable to insufficient entropy. The randomDigits method generates digits that lack a perfect distribution over enough attempts.

Recommendation

Update to version 3.1.3 or 4.1.2 or later.

References

• GitHub Issue
• security-wg
• GitHub Advisory