From 05f2bc30e08213c777ef63a6220fe0002e53b0e0 Mon Sep 17 00:00:00 2001 From: delphij Date: Sat, 19 Oct 2013 08:27:56 +0000 Subject: Document pycrypto PRNG reseed race condition. --- security/vuxml/vuln.xml | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) (limited to 'security') diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 67e42fbbf88f..5eac599ba274 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -51,6 +51,41 @@ Note: Please add new entries to the beginning of this file. --> + + pycrypto -- PRNG reseed race condition + + + py26-pycrypto + py27-pycrypto + py31-pycrypto + py32-pycrypto + py33-pycrypto + 2.6.1 + + + + +

Dwayne Litzenberger reports:

+
In PyCrypto before v2.6.1, the Crypto.Random pseudo-random + number generator (PRNG) exhibits a race condition that may cause + it to generate the same 'random' output in multiple processes that + are forked from each other. Depending on the application, this + could reveal sensitive information or cryptographic keys to remote + attackers.
+

+ + + + CVE-2013-1445 + http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html + + + 2013-10-17 + 2013-10-19 + + + wordpress -- multiple vulnerabilities -- cgit