oss-security - Re: CVE Request -- perl-Crypt-DSA -- Cryptographically insecure method used for random numbers generation on systems without /dev/random

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <04023c2b-77dd-4c62-a3e8-cbfd9cff6a71@zmail01.collab.prod.int.phx2.redhat.com>
Date: Wed, 05 Oct 2011 15:23:53 -0400 (EDT)
From: Josh Bressers <bressers@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE Request -- perl-Crypt-DSA -- Cryptographically insecure method used for random numbers generation on systems without /dev/random

Please use CVE-2011-3599 for this.

Thanks.

-- 
    JB

----- Original Message -----
> Hello Josh, Steve, vendors,
> 
>    it has been reported that Crypt::DSA, a Perl module for DSA
> signatures and key generation, used cryptographically weak / insecure
> method for random numbers generation on systems, where /dev/random
> file
> was not present. Due this flaw an attacker could be able to discover
> some portions of / whole secret DSA key, which has been created on
> such
> system.
> 
> References:
> [1] http://secunia.com/advisories/46275/
> [2] https://rt.cpan.org/Public/Bug/Display.html?id=71421
> [3] https://bugzilla.redhat.com/show_bug.cgi?id=743567
> 
> Proposed upstream patch is to remove the affected fallback code part:
> [4] https://rt.cpan.org/Public/Bug/Display.html?id=71421#txn-984052
>      (though not approved yet)
> 
> Could you allocate a CVE id for this?
> 
> Thank you && Regards, Jan.
> --
> Jan iankko Lieskovsky / Red Hat Security Response Team
>

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.