Package: pwgen Version: 2.06-1+b2 Severity: important pwgen tries to obtain its randomness from the following sources, in order: * /dev/urandom * /dev/random * a combination of getpid(), getpgrp() and gettimeofday()
The last is inappropriate for security purposes such as password generation. A failure to open the device files may occur: * in a chroot that lacks /dev files * with a pathological selinux policy * when a local attacker exhausts the system-wide descriptor limit -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
