CVE-2016-3704: High severity red hat fedora vulnerability
Pulp before 2.8.5 uses bash's $RANDOM in an unsafe way to generate passwords.
Other sources
Randy Barlow of Red Hat reports:
In working on another security issue in this same script, I noticed that Pulp's pulp-qpid-ssl-cfg script uses bash's $RANDOM in unsafe ways. One of them is already being fixed as part of another CVE (the TMP directory is unsafe, CVE-2016-3696), but the other two uses are:
0) The default NSS DB password is a single value from $RANDOM, limiting it to the strings from 0 to 32768:
https://github.com/pulp/pulp/blob/pulp-2.8.2-1/server/bin/pulp-qpid-ssl-cfg#L25 [Open URL]
1) The certutil -z flag receives a "noise file". The script uses $RANDOM to populate a file with numbers to generate this file:
https://github.com/pulp/pulp/blob/pulp-2.8.2-1/server/bin/pulp-qpid-ssl-cfg#L97-L105 [Open URL]
Since $RANDOM is used in this way, the seed file ends up having low diversity since only 11 possibly bytes appear in the file: 0-9 and newline.
I know that I can use pwgen to fix #0, but I'm not sure we want to depend on pwgen. One possibility is to avoid having a default password and force the user to provide one. Do you have a suggestion on a good way to make a password?
For #1 I will just grab 8 kB from /dev/urandom and call it a day.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3704?
CVE-2016-3704 has been classified with a moderate severity level due to its potential impact on password generation.
How do I fix CVE-2016-3704?
To fix CVE-2016-3704, upgrade Pulp to version 2.8.5 or later.
What systems are affected by CVE-2016-3704?
CVE-2016-3704 affects Pulp versions up to 2.8.4 and Fedora 24.
What is the nature of the vulnerability in CVE-2016-3704?
CVE-2016-3704 involves the unsafe use of bash's $RANDOM for generating passwords, which can lead to predictable password generation.
Who reported the vulnerability CVE-2016-3704?
Randy Barlow of Red Hat reported the vulnerability CVE-2016-3704.