Bug 743567 - (CVE-2011-3599) CVE-2011-3599 perl-Crypt-DSA: Cryptographically insecure method used for random numbers generation on systems without /dev/random
CVE-2011-3599 perl-Crypt-DSA: Cryptographically insecure method used for rand...
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,public=20111003,reported=2...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2011-10-05 08:00 EDT by Jan Lieskovsky
Modified: 2013-09-19 15:41 EDT (History)
3 users (show)

See Also:
Fixed In Version: perl-Crypt-DSA-1.17-10.*, perl-Crypt-DSA-0.14-8.el5
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2013-09-19 15:41:45 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
CPAN 71421 None None None Never

  None (edit)
Description Jan Lieskovsky 2011-10-05 08:00:01 EDT
It has been reported that Crypt::DSA, a Perl module for DSA signatures and key generation, used cryptographically weak / insecure method for random numbers generation on systems, where /dev/random file was not present. Due this flaw an attacker could be able to discover some portions of / whole secret DSA key, which has been created on such system.

References:
[1] http://secunia.com/advisories/46275/
[2] https://rt.cpan.org/Public/Bug/Display.html?id=71421

Proposed upstream patch is to remove the affected fallback code part:
[3] https://rt.cpan.org/Public/Bug/Display.html?id=71421#txn-984052
    (though not approved yet)
Comment 1 Jan Lieskovsky 2011-10-05 08:04:34 EDT
CVE Request:
[4] http://www.openwall.com/lists/oss-security/2011/10/05/5
Comment 2 Jan Lieskovsky 2011-10-05 08:08:34 EDT
This issue affects the versions of the perl-Crypt-DSA package, as shipped with Fedora release of 14, 15, and as shipped within EPEL-4, EPEL-5 and EPEL-6 repositories.

Under 'affects' I mean that the relevant code part / fallback is present in the code. 

Though obviously on Fedora and EPEL systems, the safer /dev/random code branch would be used for DSA key generation. Thus this deficiency would not show and I will leave the decision to the perl-Crypt-DSA module developers, if it's worthy to schedule new Fedora / EPEL updates or not.
Comment 3 Paul Howarth 2011-10-05 09:58:36 EDT
Given that no Fedora/EPEL system is actually going to be impacted by this, I'm inclined to wait until there's a new upstream release before "fixing" it.
Comment 4 Jan Lieskovsky 2011-10-06 04:52:51 EDT
The CVE identifier of CVE-2011-3599 has been assigned to this issue:
http://www.openwall.com/lists/oss-security/2011/10/05/9
Comment 6 Petr Pisar 2013-09-03 05:03:03 EDT
Does SELinux policy deny access to /dev/random in some cases? If yes, then such process would be affected.

I can imagine an administrator will confine a third-party application by assigning a dedicated label to increase security. Because default policy is to deny, the DSA generation will get doomed.
Comment 7 Paul Howarth 2013-09-03 05:32:24 EDT
You're right. I'll look at doing an update later today.
Comment 8 Fedora Update System 2013-09-12 21:10:29 EDT
perl-Crypt-DSA-1.17-10.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 Fedora Update System 2013-09-12 21:11:31 EDT
perl-Crypt-DSA-1.17-10.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 10 Fedora Update System 2013-09-19 15:33:20 EDT
perl-Crypt-DSA-0.14-8.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 11 Fedora Update System 2013-09-19 15:33:59 EDT
perl-Crypt-DSA-1.17-10.el6 has been pushed to the Fedora EPEL 6 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 12 Paul Howarth 2013-09-19 15:41:45 EDT
This is now fixed in all current Fedora and EPEL releases.

Note You need to log in before you can comment on or make changes to this bug.