瀏覽代碼

Use cryptographically secure random number generator.
Fixes CVE-2022-29245.

drieseng 3 年之前
父節點
當前提交
03c6d60736
共有 1 個文件被更改,包括 1 次插入3 次删除
  1. 1 3
      src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs

+ 1 - 3
src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs

@@ -46,9 +46,7 @@ namespace Renci.SshNet.Security
             var basepoint = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
             basepoint[0] = 9;
 
-            var rnd = new Random();
-            _privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];
-            rnd.NextBytes(_privateKey);
+            _privateKey = CryptoAbstraction.GenerateRandom(MontgomeryCurve25519.PrivateKeySizeInBytes);
 
             _clientExchangeValue = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
             MontgomeryOperations.scalarmult(_clientExchangeValue, 0, _privateKey, 0, basepoint, 0);