Open Stack

That would be a welcome strengthening, but I don't think this is
exploitable as is.

** Changed in: ossa
       Status: Incomplete => Won't Fix

** Information type changed from Public Security to Public

** Tags added: security

-- 
You received this bug notification because you are a member of OpenStack
Security Group, which is subscribed to OpenStack.
https://bugs.launchpad.net/bugs/1319643

Title:
  Using random.random() should not be used to generate randomness used
  for security reasons

Status in Cinder:
  Triaged
Status in OpenStack Security Advisories:
  Won't Fix

Bug description:
  In cinder code : /cinder/transfer/api.py . Below line of code used
  random.random() to generate a random number, Standard random number
  generators should not be used to generate randomness used for security
  reasons. Could we use a crytographic randomness generator to provide
  sufficient entropy to instead of it?

  rndstr = ""
  random.seed(datetime.datetime.now().microsecond)
  while len(rndstr) < length:
   rndstr += hashlib.sha224(str(random.random())).hexdigest()   ---------------> This line has described issues. 

   return rndstr[0:length]

To manage notifications about this bug go to:
https://bugs.launchpad.net/cinder/+bug/1319643/+subscriptions