Explorar o código

Use cryptographically secure random number generator.
Fixes CVE-2022-29245.

drieseng %!s(int64=3) %!d(string=hai) anos
pai
achega
03c6d60736
Modificáronse 1 ficheiros con 1 adicións e 3 borrados
  1. 1 3
      src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs

+ 1 - 3
src/Renci.SshNet/Security/KeyExchangeECCurve25519.cs

@@ -46,9 +46,7 @@ namespace Renci.SshNet.Security
             var basepoint = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
             basepoint[0] = 9;
 
-            var rnd = new Random();
-            _privateKey = new byte[MontgomeryCurve25519.PrivateKeySizeInBytes];
-            rnd.NextBytes(_privateKey);
+            _privateKey = CryptoAbstraction.GenerateRandom(MontgomeryCurve25519.PrivateKeySizeInBytes);
 
             _clientExchangeValue = new byte[MontgomeryCurve25519.PublicKeySizeInBytes];
             MontgomeryOperations.scalarmult(_clientExchangeValue, 0, _privateKey, 0, basepoint, 0);