Call to Random API
Call to Random API
Description
List of all calls to methods that return pseudo-random values.
Recommendation
Do not seed Random with the current time because that value is more predictable to an attacker than the default seed.
The java.util.Random class must not be used either for security-critical applications or for protecting sensitive data.
Use a more secure random number generator, such as the java.security.SecureRandom class.
Links
- CWE-330: Use of Insufficiently Random Values
- MSC02-J. Generate strong random numbers (CERT Secure Coding)
Standards
- OWASP_MASVS_L1:
- MSTG_CRYPTO_1
- OWASP_MASVS_L2:
- MSTG_CRYPTO_1