Critical vulnerability leading to admin takeover

[adrian-rt]

Hi all,

I wanted to bring your attention to a critical issue outlined in our research here:

https://fortbridge.co.uk/research/vesta-admin-takeover-exploiting-reduced-seed-entropy-in-bash-random/

We have attempted to reach out through various channels but have not received any response.

As a potential fix, we recommend generating passwords and tokens by reading from /dev/urandom, which provides cryptographically secure random numbers.

Please let me know if you have any questions or need further assistance.

[industrial64]

Please see #2254

[Neustradamus]

A long time ago, I have requested a new release build with fixes:

• New release version? #2280