Date: Sat, 19 Oct 2013 08:27:56 +0000 (UTC) From: Xin LI <delphij@FreeBSD.org> To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r330854 - head/security/vuxml Message-ID: <201310190827.r9J8RurS089500@svn.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: delphij Date: Sat Oct 19 08:27:56 2013 New Revision: 330854 URL: http://svnweb.freebsd.org/changeset/ports/330854 Log: Document pycrypto PRNG reseed race condition. Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Oct 19 08:11:27 2013 (r330853) +++ head/security/vuxml/vuln.xml Sat Oct 19 08:27:56 2013 (r330854) @@ -51,6 +51,41 @@ Note: Please add new entries to the beg --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">; + <vuln vid="c0f122e2-3897-11e3-a084-3c970e169bc2"> + <topic>pycrypto -- PRNG reseed race condition</topic> + <affects> + <package> + <name>py26-pycrypto</name> + <name>py27-pycrypto</name> + <name>py31-pycrypto</name> + <name>py32-pycrypto</name> + <name>py33-pycrypto</name> + <range><lt>2.6.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Dwayne Litzenberger reports:</p> + <blockquote cite="http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html">; + <p>In PyCrypto before v2.6.1, the Crypto.Random pseudo-random + number generator (PRNG) exhibits a race condition that may cause + it to generate the same 'random' output in multiple processes that + are forked from each other. Depending on the application, this + could reveal sensitive information or cryptographic keys to remote + attackers.</p> + </blockquote> + </body> + </description> + <references> + <cvename>CVE-2013-1445</cvename> + <url>http://lists.dlitz.net/pipermail/pycrypto/2013q4/000702.html</url>; + </references> + <dates> + <discovery>2013-10-17</discovery> + <entry>2013-10-19</entry> + </dates> + </vuln> + <vuln vid="043d3a78-f245-4938-9bc7-3d0d35dd94bf"> <topic>wordpress -- multiple vulnerabilities</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201310190827.r9J8RurS089500>