Date: Wed, 05 Oct 2011 14:03:19 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security@...ts.openwall.com Subject: CVE Request -- perl-Crypt-DSA -- Cryptographically insecure method used for random numbers generation on systems without /dev/random Hello Josh, Steve, vendors, it has been reported that Crypt::DSA, a Perl module for DSA signatures and key generation, used cryptographically weak / insecure method for random numbers generation on systems, where /dev/random file was not present. Due this flaw an attacker could be able to discover some portions of / whole secret DSA key, which has been created on such system. References:  http://secunia.com/advisories/46275/  https://rt.cpan.org/Public/Bug/Display.html?id=71421  https://bugzilla.redhat.com/show_bug.cgi?id=743567 Proposed upstream patch is to remove the affected fallback code part:  https://rt.cpan.org/Public/Bug/Display.html?id=71421#txn-984052 (though not approved yet) Could you allocate a CVE id for this? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.