There is really very low exposure here
** Changed in: nova
Status: Confirmed => Opinion
--
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to OpenStack Compute (nova).
https://bugs.launchpad.net/bugs/1246160
Title:
shuffle method bring potential security issue
Status in OpenStack Compute (nova):
Opinion
Status in OpenStack Security Advisory:
Invalid
Bug description:
In the /nova/utils.py, line 328, the source code is below
r.shuffle(password)
This code is using shuffle method to generate a random number,
Standard random number generators should not be used to generate
randomness used for security reasons. For security sensitive
randomness a crytographic randomness generator that provides
sufficient entropy should be used.
To manage notifications about this bug go to:
https://bugs.launchpad.net/nova/+bug/1246160/+subscriptions
--
Mailing list: https://launchpad.net/~yahoo-eng-team
Post to : [email protected]
Unsubscribe : https://launchpad.net/~yahoo-eng-team
More help : https://help.launchpad.net/ListHelp
