3 ms·

Exhibit A: CVE-2013-2228. As described inthe relevant entry [0] on Debian's Security Tracker: > SaltStack RSA Key Generation allows remote users to decrypt co

• sushisource 6y ago
  Jesus that's some rookie stuff right there
  • lima 6y ago
    They also built their own low-level network protocol based on 0mq. Back when I tried it, it had constant keepalive issues behind NAT and would randomly lose messages (that was in 2014, probably better now).
    • xenophonf 6y ago
      It wasn't any better as of last year, and its constant connectivity issues were part of the reason I abandoned it.
  • nemothekid 6y ago
    This is rookie stuff, but it’s a recurring security issue where crypto libraries have APIs littered with footguns. The “lambda x, y, z: None” just strikes me as cargo culting copy paste code - I’m willing to bet there is other software with the same exploit as they all copied the same answer on StackOverflow
• correct_horse 6y ago
  The second parameter in the gen_key function is the RSA public exponent. I believe this means the ciphertext will be the same as the padded plaintext. Here is the documentation from the RSA.gen_key() function. def gen_key(bits, e, callback=keygen_callback): # type: (int, int, Callable) -> RSA """ Generate an RSA key pair. :param bits: Key length, in bits. :param e: The RSA public exponent. :param callback: A Python callable object that is invoked during key generation; its usual purpose is to provide visual feedback. The default callback is keygen_callback. :return: M2Crypto.RSA.RSA object. """ https://gitlab.com/m2crypto/m2crypto/-/blob/master/M2Crypto/RSA.py#L346 https://gitlab.com/m2crypto/m2crypto/-/blob/master/M2Crypto/...
• cyberfart 6y ago
  This is reminiscent of int getRandomNumber() { return 4; // chosen by fair dice roll. // guaranteed to be random. }