duo_unix icon indicating copy to clipboard operation
duo_unix copied to clipboard

https_init: result from `RAND_load_file` is unchecked

Open ngie-eign opened this issue 8 months ago • 0 comments

In the event the PRNG hasn't been sufficiently seeded and $RANDFILE points to an invalid file (for instance), any failure that occurs on line 405 in https_init will be ignored.

The call should be checked to ensure that the PRNG is indeed properly seeded by duo_unix -- otherwise crypto guarantees could be invalidated by the weakness.

Reported by Coverity.

https://github.com/duosecurity/duo_unix/blob/5ca4f5ad728fef20e04606dcd12ee5b949693f04/lib/https.c#L405

ngie-eign avatar Jun 06 '24 02:06 ngie-eign