Spam #159366

Bug report

Is this a real issue or hallucination?

Security — ship blockers
🛡 Run security review ($)
Last review: 10/13/2026, 8:52:40 AM · ollama · evidence: 6 sensitive sinks, 940 entry points, 2 API routes
No evidence-backed catastrophic ship blockers were identified from the available repository evidence.

Could not be confirmed (1) — attack path names functions or files Codemd could not find in this repository
RSA Cipher — Weak Random Number Generation in Key Generation
Confidence: HIGH
✗ Not found in this repository: random.randrange — this chain may be invented.
Catastrophic outcome
Predictable RSA keys that can be exploited to compromise encryption security
Attack path
✓Entry point: generate_key function in rsa_key_generator.py ciphers.rsa_key_generator.generate_key
✓→ Prime generation uses non-cryptographically secure random number generator ciphers.rabin_miller.generate_large_prime
✗→ random.randrange() function used instead of cryptographically secure secrets module random.randrange
Why this is reachable
The generate_key function is a core RSA cipher function that calls generate_large_prime, which directly uses the insecure random number generator.
Required attacker capability
Ability to predict or reproduce RSA keys used for encryption
Security boundary crossed
Repository data → cryptographic key generation
Blast radius
All RSA-encrypted data that uses keys generated with this method
Exact remediation
Replace random.randrange() calls with secrets.randbelow() or similar cryptographically secure random number generator
Regression test
Verify that generate_key function now uses a cryptographically secure random number generator and produces different keys on each run

CPython versions tested on:

3.15

Operating systems tested on:

Windows