Date: Wed, 26 Jun 2013 14:39:49 +1000 From: Michael Samuel <mik@...net.net> To: oss-security@...ts.openwall.com Subject: Re: KDE Paste Applet On 13 June 2013 10:02, Michael Samuel <mik@...net.net> wrote: > Ok, so the fix for this uses KRandom::random()... > > I suggest leaving the KDE Paste fix as-is and replacing KRandom with > something that just fills an integer from /dev/urandom - then we can save a > few CVE numbers for the rest of the year. > > qrand() should probably also do the same, especially since cnonces for > HTTP auth are using it - that means there's only 2^32 (at best) possible > cnonces... > >> >> Fedora and Ubuntu have both pushed out this patch. Requesting a new CVE for "KRandom::random() isn't a secure PRNG", since the KDE guys are convinced that it is. Regards, Michael
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.