CVE-2020-35926

Name of the Vulnerable Software and Affected Versions nanorand versions prior to 0.5.1

Description An issue in the nanorand crate caused random number generators, including the cryptographically secure ChaCha, to return all zeroes due to mishandled integer truncation. This occurred because the implementation used bit-shifting to truncate a 64-bit number instead of an as conversion, leading to improper number generation.

Recommendations For versions prior to 0.5.1, update to version 0.5.1 or later to resolve the issue. As a temporary workaround, consider avoiding the use of random number generators that rely on the affected RandomGen implementations until a patch is available.