Read Time:37 Second

FEDORA-2024-63f98f8c60

Packages in this update:

aws-2020-16.1.fc40

Update description:

CVE-2024-41708: Ada Web Server did not use a cryptographically secure pseudorandom number generator.

AWS.Utils.Random and AWS.Utils.Random_String used Ada.Numerics.Discrete_Random, which is not designed to be cryptographically secure. Random_String also introduced a bias in the generated pseudorandom string values, where the values “1” and “2” had a much higher frequency than any other character.

The internal state of the Mersenne Twister PRNG could be revealed, and lead to a session hijacking attack.

This update fixes the problem by using /dev/urandom instead of Discrete_Random.

More details: https://docs.adacore.com/corp/security-advisories/SEC.AWS-0040-v2.pdf

Read More