CVE Request: pwgen

[Seth Arnold <seth.arnold () canonical com>]

Hello Kurt, Steve, all,

Do these issues deserve CVE numbers?

A user reported to launchpad [1] that pwgen will use /dev/urandom or
/dev/random if it can, but will silently fall back to using drand48() or
random() if the device files fail to open. The report also mentions that
when the device files are available, the output is biased by too-simple
use of the modulo operator to scale the output to 0 <= n < max. There
are further complaints about the poor use of available entropy when
seeding the weaker algorithms.

A potentially related complaint is in Debian's BTS [2]: in this bug
report, the user wanted a way to force use of /dev/random even if
/dev/urandom is available.

I've pasted the relevant source to pastebin.ubuntu.com [3].

Are any of these worthy of a CVE number?

- silent fall-back to weak algorithms
- biased output due to poor use of modulo operations
- poor seeding of weak algorithms

Thank you

1: https://bugs.launchpad.net/ubuntu/+source/pwgen/+bug/1183213
2: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=672241
3: http://pastebin.ubuntu.com/5698361/

Attachment: signature.asc
Description: Digital signature