Bug#930660: libapache-sessionx-perl: poor source of entropy for session id generation

Control: severity -1 serious On Sat, 17 May 2025 13:38:22 +0300, Niko Tyni wrote: On Mon, Jun 17, 2019 at 10:44:52PM +0200, Raphael Geissert wrote: Package: libapache-sessionx-perl Version: 2.01-5 Severity: important Tags: security Hi, As discussed in oss-security[1], libapache-sessionx-perl

Bug#930660: libapache-sessionx-perl: poor source of entropy for session id generation

On Mon, Jun 17, 2019 at 10:44:52PM +0200, Raphael Geissert wrote: > Package: libapache-sessionx-perl > Version: 2.01-5 > Severity: important > Tags: security > > Hi, > > As discussed in oss-security[1], libapache-sessionx-perl uses a poor > source of entropy in Apache::Session::Generate::MD5. The

Bug#930660: libapache-sessionx-perl: poor source of entropy for session id generation

Package: libapache-sessionx-perl Version: 2.01-5 Severity: important Tags: security Hi, As discussed in oss-security[1], libapache-sessionx-perl uses a poor source of entropy in Apache::Session::Generate::MD5. The critical part is moving away from rand (e.g. to using urandom), but it would also b