[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: about python-oauth2: CVE-2013-4347




Le 9 oct. 2013 01:42, "Paul Wise" <pabs@debian.org> a écrit :
>
> On Wed, Oct 9, 2013 at 5:46 AM, Philippe Makowski wrote:
>
> > do you think that for fixing that, using
> >
> > return ''.join(random.choice('abcdefghijklmnopqrstuvwxyz123456789') for
> > i in xrange(length))
> ...
> > would be an acceptable fix ?
>
> No, from the announcement of this issue on oss-sec:
>
> ... the Python 'random' documentation clearly states the results are
> repeatable ...
>
> http://www.openwall.com/lists/oss-security/2013/09/12/5
>
Any suggestion then ?
Is there someone working on this ?
Where are the sources of the package ?


Reply to: