Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
paragonie/random_compat
master @ b5d188c
3
Fixes
0
CVEs
HIGH
Peak severity
33.3%
Coverage
Highlights
Insecure Cryptography: 2 prior fixes. Scrutinize any change in this area.
lib/random.php: most-fixed (2 issues). Treat as high-risk during review.
2 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Insecure Cryptography: The project relied on an insecure fallback source (openssl_random_pseudo_bytes) which does not guarantee cryptographically secure outputs in all PHP configurations, necessitating its complete removal to maintain library integrity.
Insecure Cryptography: Insufficient bounds validation on user-supplied float values representing byte lengths could lead to integer wrapping or out-of-bounds execution inside the sodium-backed random bytes polyfill.
Insecure Randomness: A case-sensitive check against 'COM' inside disabled_classes could allow bypasses of the safety check when attempting to instantiate CAPICOM objects on Windows systems, potentially leading to errors or unsafe behaviors.