chore: use random_int() in some places

[DanielRuf]

Description

This PR is for evaluating the possible increased security for generating random numbers in some modules.

Contribution checklist

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• All automated tests passed successfully (all builds on Travis CI are green)

[magento-engcom-team]

Hi @DanielRuf. Thank you for your contribution.
Changes from your Pull Request will be available with the upcoming 2.2.5 release.

[barryvdh]

This does not seem to be in 2.2.5; https://github.com/magento/magento2/blob/2.2.5/lib/internal/Magento/Framework/Encryption/Crypt.php#L78

This issue is registered as security vulnerability CVE-2016-6485 so would be great if this can be fixed in the next release. See https://www.cvedetails.com/cve/CVE-2016-6485/

[DanielRuf]

This does not seem to be in 2.2.5; /lib/internal/Magento/Framework/Encryption/Crypt.php@2.2.5#L78

This issue is registered as security vulnerability CVE-2016-6485 so would be great if this can be fixed in the next release. See cvedetails.com/cve/CVE-2016-6485

It will be in 2.2.6

[DanielRuf]

Also this is an older CVE and 5.5/10 is not so critical.

[DanielRuf]

So this is not a 0day in general.

[barryvdh]

Yeah it's old, but still open. Don't know if that makes it better ;)

Not a big issue, just nice to have closed. Also for other tools that check if you use projects with known security issues. Nice to have fixed, just expected it in 2.2.5 because of the comment saying it was in 2.2.5

[DanielRuf]

Well, the release bot of Magento had the wrong date and so this will be definitely in the next release. So it will be finally fixed in 2.2.6.

Not sure who said that it is fixed yet but this is not correct as you can see.

[DanielRuf]

just expected it in 2.2.5 because of the comment saying it was in 2.2.5

Never trust a comment, check the code of the tagged release =)