From 444aceefa5e11a5c841ea03c8021e565d5d02a6c Mon Sep 17 00:00:00 2001 From: Matthias Gerstner Date: Tue, 11 Dec 2018 11:06:01 +0100 Subject: [PATCH] logs: actually use SystemRandom source for generating a random string The returned string was only pseudo random. It is only used for the log_capture_start() mechanism at the moment. Therefore an attacker might be able to guess the tokens of other users. Since this data it publicly available anyways it should not be a big issue, however. --- tuned/logs.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tuned/logs.py b/tuned/logs.py index 4370e22..bd1b6ec 100644 --- a/tuned/logs.py +++ b/tuned/logs.py @@ -30,7 +30,7 @@ def _random_string(length): chars = string.ascii_letters + string.digits res = "" for i in range(length): - res += random.choice(chars) + res += r.choice(chars) return res def log_capture_start(log_level):