Bug 1424992 (CVE-2017-2626)
| Summary: | CVE-2017-2626 libICE: weak entropy usage in session keys | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Martin Prpič <mprpic> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | low | Docs Contact: | |
| Priority: | low | ||
| Version: | unspecified | CC: | btissoir, dmoppert, sandmann, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: |
It was discovered that libICE used a weak entropy to generate keys. A local attacker could potentially use this flaw for session hijacking using the information available from the process list.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2017-03-01 00:37:11 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1427715, 1431691 | ||
| Bug Blocks: | 1424993 | ||
|
Description
Martin Prpič
2017-02-20 09:34:20 UTC
Acknowledgments: Name: Eric Sesterhenn (X41 D-Sec GmbH) Adjusted CVSS scoring and reduced impact to Low based on requiring the attacker needing to be logged in locally, and ICE's only visible use in RHEL being XSMP session managers, whose disruption is of limited impact. Created libICE tracking bugs for this issue: Affects: fedora-all [bug 1427715] Statement: Red Hat Product Security has rated this issue as having Low security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. Original reporter's advisory: https://www.x41-dsec.de/lab/advisories/x41-2017-001-xorg/ Upstream commit: https://cgit.freedesktop.org/xorg/lib/libICE/commit/?id=ff5e59f32255913bb1cdf51441b98c9107ae165b This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2017:1865 https://access.redhat.com/errata/RHSA-2017:1865 |