[Openstack-security] [Bug 1246158] Re: randint method brings potential security issue
Brant Knudson
bknudson at us.ibm.com
Thu Feb 20 16:27:26 UTC 2014
** Also affects: keystone
Importance: Undecided
Status: New
--
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1246158
Title:
randint method brings potential security issue
Status in OpenStack Identity (Keystone):
New
Status in OpenStack Compute (Nova):
Invalid
Status in OpenStack Security Advisories:
Invalid
Bug description:
In the /keystone/contrib/oauth1/backends/sql.py, line 210, the source
code is below
token_dict['verifier'] = str(random.randint(1000, 9999))
This code is using randint method to generate a random number,
Standard random number generators should not be used to generate
randomness used for security reasons. For security sensitive
randomness a crytographic randomness generator that provides
sufficient entropy should be used.
To manage notifications about this bug go to:
https://bugs.launchpad.net/keystone/+bug/1246158/+subscriptions
More information about the Openstack-security
mailing list