On Mon, Jun 17, 2019 at 10:44:52PM +0200, Raphael Geissert wrote: > Package: libapache-sessionx-perl > Version: 2.01-5 > Severity: important > Tags: security > > Hi, > > As discussed in oss-security[1], libapache-sessionx-perl uses a poor > source of entropy in Apache::Session::Generate::MD5. The critical part > is moving away from rand (e.g. to using urandom), but it would also be > a good time to update the way the id is generated. > > The details are in the oss-sec thread. > > [1] https://www.openwall.com/lists/oss-security/2019/06/15/1
AFAICS libapache-sessionx-perl only exists to support libembperl-perl. As we're not going to ship libembperl-perl in trixie due to #1042845, I wonder if we should remove libapache-sessionx-perl from testing too? Alternatively, the approach taken for libapache-session-perl #930659 (using Crypt::URandom) seems easy to apply here as well. https://sources.debian.org/src/libapache-session-perl/1.94-2/debian/patches/use-crypt-urandom.patch/ -- Niko Tyni nt...@debian.org
