Date: Mon, 21 May 2012 14:49:51 -0400 From: Michael Gilbert <mgilbert@...ian.org> To: Kurt Seifried <kseifried@...hat.com> Cc: oss-security@...ts.openwall.com Subject: Re: CVE id request: devotee (debian vote engine) cryptographically weak random numbers permit discovery of secret ballot submissions On Fri, May 18, 2012 at 6:39 PM, Kurt Seifried wrote: > This appears to be a service more than software, and although the > source is available (see git link) it appears to be out of date? > > http://lists.debian.org/debian-www/2012/04/msg00200.html Yes, the publicly available source repo is out of date right now, but that won't always be the case. Debian had a change in secretary, so workflows have changed, and ideally a more public mode of operation should be gotten back to. > Can you confirm the vulnerability is in the software you linked to, > and that this has actually been downloaded/used outside of Debian? Yes, it is indeed an issue in the software implementation itself. See original report for exact code lines that are flawed. I can neither confirm nor not confirm that devotee is used outside of debian, but it does seem like an obvious choice for online election management. It is however planned to be package for debian , and ubuntu automatically syncs debian, so eventually they will also get the package. it is important that an id be assigned so that they are aware that they will need to check the package when they do that sync.  http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=470995
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.