[Openstack-security] [Bug 1246160] Re: shuffle method bring potential security issue
Jeremy Stanley
fungi at yuggoth.org
Tue Nov 12 01:43:08 UTC 2013
** Information type changed from Private Security to Public
** Changed in: ossa
Status: Incomplete => Invalid
** Tags added: security
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1246160
Title:
shuffle method bring potential security issue
Status in OpenStack Compute (Nova):
New
Status in OpenStack Security Advisories:
Invalid
Bug description:
In the /nova/utils.py, line 328, the source code is below
r.shuffle(password)
This code is using shuffle method to generate a random number,
Standard random number generators should not be used to generate
randomness used for security reasons. For security sensitive
randomness a crytographic randomness generator that provides
sufficient entropy should be used.
To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1246160/+subscriptions
More information about the Openstack-security
mailing list