Re: KDE Paste Applet

[Michael Samuel <mik () miknet net>]

On 13 June 2013 10:02, Michael Samuel <mik () miknet net> wrote:

> Ok, so the fix for this uses KRandom::random()...
>
> I suggest leaving the KDE Paste fix as-is and replacing KRandom with
> something that just fills an integer from /dev/urandom - then we can save a
> few CVE numbers for the rest of the year.
>
> qrand() should probably also do the same, especially since cnonces for
> HTTP auth are using it - that means there's only 2^32 (at best) possible
> cnonces...
>
> >
Fedora and Ubuntu have both pushed out this patch.  Requesting a new CVE
for "KRandom::random() isn't a secure PRNG", since the KDE guys are
convinced that it is.

Regards,
  Michael