CVE request for saltstack

[Kurt Seifried <kseifried () redhat com>]

So someone pointed this out to me:

https://github.com/saltstack/salt/commit/e8ce66cf688b43aeb3e716e78b1af3a08e9940e3

     priv = '{0}.pem'.format(base)
     pub = '{0}.pub'.format(base)

-    gen = RSA.gen_key(keysize, 1, callback=lambda x, y, z: None)
+    gen = RSA.gen_key(keysize, 65537, callback=lambda x, y, z: None)
     cumask = os.umask(191)
     gen.save_key(priv, None)
     os.umask(cumask)

This is using the M2Crypto.RSA.

TL;DR: doing RSA crypto with a public exponent value of "1" makes crypto
very fast. Fast is not always good.

Can we get a CVE for this please?



-- 

--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Red Hat Product Security contact: secalert () redhat com