shuffle method bring potential security issue

[Bin Hou]

In the /nova/utils.py, line 328, the source code is below

            r.shuffle(password)

This code is using shuffle method to generate a random number, Standard random number generators should not be used to generate randomness used for security reasons. For security sensitive randomness a crytographic randomness generator that provides sufficient entropy should be used.

[Thierry Carrez (ttx)]

While I agree that using a more random RNG in this case makes sense, I don't think its use in this particular instance would trigger a practically exploitable vulnerability.

As such, I think we can open this bug publicly and push a patch to improve this into future versions of OpenStack. If you agree to make the issue public, I'll open this bug unless someone objects.

[Bin Hou (binhou)]

I am fine to make the issue public and make improvments in future release

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/210092

[stgleb (gstepanov)]

Cale Rath, are you still working on this patch?

[OpenStack Infra (hudson-openstack)]

Change abandoned by Matt Riedemann (<email address hidden>) on branch: master
Review: https://review.openstack.org/210092

[Markus Zoeller (markus_z) (mzoeller)]

Cleanup
=======

There are no open reviews for this bug report since more than 2 weeks.
To signal that to other contributors which might provide patches for
this bug, I switch the status from "In Progress" to "Confirmed" and
remove the assignee.
Feel free to add yourself as assignee and to push a review for it.

[Sean Dague (sdague)]

There is really very low exposure here