oss-security - CVE Request -- perl-Crypt-DSA -- Cryptographically insecure method used for random numbers generation on systems without /dev/random

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <4E8C4787.7040002@redhat.com>
Date: Wed, 05 Oct 2011 14:03:19 +0200
From: Jan Lieskovsky <jlieskov@...hat.com>
To: "Steven M. Christey" <coley@...us.mitre.org>
CC: oss-security@...ts.openwall.com
Subject: CVE Request -- perl-Crypt-DSA -- Cryptographically insecure method
 used for random numbers generation on systems without /dev/random

Hello Josh, Steve, vendors,

   it has been reported that Crypt::DSA, a Perl module for DSA
signatures and key generation, used cryptographically weak / insecure
method for random numbers generation on systems, where /dev/random file
was not present. Due this flaw an attacker could be able to discover
some portions of / whole secret DSA key, which has been created on such
system.

References:
[1] http://secunia.com/advisories/46275/
[2] https://rt.cpan.org/Public/Bug/Display.html?id=71421
[3] https://bugzilla.redhat.com/show_bug.cgi?id=743567

Proposed upstream patch is to remove the affected fallback code part:
[4] https://rt.cpan.org/Public/Bug/Display.html?id=71421#txn-984052
     (though not approved yet)

Could you allocate a CVE id for this?

Thank you && Regards, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.