Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

Updated pwgen package fixes security vulnerabilities :

Pwgen was found to generate weak non-tty passwords by default, which could be brute-forced with a commendable success rate, which could raise security concerns (CVE-2013-4440).

Pwgen was found to silently falling back to use standard pseudo generated numbers on the systems that heavily use entropy. Systems, such as those with a lot of daemons providing encryption services, the entropy was found to be exhausted, which forces pwgen to fall back to use standard pseudo generated numbers (CVE-2013-4442).

Update to 2.07 (bug 1159526) fixes :

  - CVE-2013-4440 (bug 1020222, 1020223)

    - CVE-2013-4442 (bug 1020259, 1020261)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
80427	Mandriva Linux Security Advisory : pwgen (MDVSA-2015:008)	Nessus	Mandriva Local Security Checks	medium
80063	Fedora 19 : pwgen-2.07-1.fc19 (2014-16473)	Nessus	Fedora Local Security Checks	medium
79944	Fedora 21 : pwgen-2.07-1.fc21 (2014-16406)	Nessus	Fedora Local Security Checks	medium
79937	Fedora 20 : pwgen-2.07-1.fc20 (2014-16368)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2013-4442

high

Tenable Plugins

medium

medium

medium

medium