Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Wed, 26 Jun 2013 14:39:49 +1000
From: Michael Samuel <>
Subject: Re: KDE Paste Applet

On 13 June 2013 10:02, Michael Samuel <> wrote:

> Ok, so the fix for this uses KRandom::random()...
> I suggest leaving the KDE Paste fix as-is and replacing KRandom with
> something that just fills an integer from /dev/urandom - then we can save a
> few CVE numbers for the rest of the year.
> qrand() should probably also do the same, especially since cnonces for
> HTTP auth are using it - that means there's only 2^32 (at best) possible
> cnonces...
Fedora and Ubuntu have both pushed out this patch.  Requesting a new CVE
for "KRandom::random() isn't a secure PRNG", since the KDE guys are
convinced that it is.


Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.