[Openstack-security] [Bug 1246158] Re: randint method brings potential security issue
Russell Bryant
1246158 at bugs.launchpad.net
Fri Feb 7 18:16:01 UTC 2014
marked invalid for nova as this is talking about keystone code
** Changed in: nova
Status: New => Invalid
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1246158
Title:
randint method brings potential security issue
Status in OpenStack Compute (Nova):
Invalid
Status in OpenStack Security Advisories:
Invalid
Bug description:
In the /keystone/contrib/oauth1/backends/sql.py, line 210, the source
code is below
token_dict['verifier'] = str(random.randint(1000, 9999))
This code is using randint method to generate a random number,
Standard random number generators should not be used to generate
randomness used for security reasons. For security sensitive
randomness a crytographic randomness generator that provides
sufficient entropy should be used.
To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1246158/+subscriptions
More information about the Openstack-security
mailing list