Details
-
Improvement
-
Status: Resolved
-
Major
-
Resolution: Duplicate
-
1.3.0
-
None
Description
Currently the UUIDs used for scanner IDs are using boost::uuid, which doesn't necessarily use a secure random source. If these turn out to be predictable, some attack around scanner hijacking might be possible. We should use an unpredictable source for scanner IDs, or save the original authenticated user in the Scanner and ensure that the authentication does not switch mid-scan.
Attachments
Issue Links
- is duplicated by
-
KUDU-1843 Client UUIDs should be cryptographically random
- In Review