[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Mon, 21 May 2012 14:49:51 -0400
From: Michael Gilbert <mgilbert@...ian.org>
To: Kurt Seifried <kseifried@...hat.com>
Cc: oss-security@...ts.openwall.com
Subject: Re: CVE id request: devotee (debian vote engine)
cryptographically weak random numbers permit discovery of secret ballot submissions
On Fri, May 18, 2012 at 6:39 PM, Kurt Seifried wrote:
> This appears to be a service more than software, and although the
> source is available (see git link) it appears to be out of date?
>
> http://lists.debian.org/debian-www/2012/04/msg00200.html
Yes, the publicly available source repo is out of date right now, but
that won't always be the case. Debian had a change in secretary, so
workflows have changed, and ideally a more public mode of operation
should be gotten back to.
> Can you confirm the vulnerability is in the software you linked to,
> and that this has actually been downloaded/used outside of Debian?
Yes, it is indeed an issue in the software implementation itself. See
original report for exact code lines that are flawed.
I can neither confirm nor not confirm that devotee is used outside of
debian, but it does seem like an obvious choice for online election
management. It is however planned to be package for debian [0], and
ubuntu automatically syncs debian, so eventually they will also get
the package. it is important that an id be assigned so that they are
aware that they will need to check the package when they do that sync.
[0] http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=470995
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
