From bffd43648d9018a6e1cc861553b29c0a3501099e Mon Sep 17 00:00:00 2001
From: jesopo
Date: Wed, 6 Feb 2019 21:49:24 +0000
Subject: uuid.uuid4() is not random enough for a nonce (sasl.scram)

---
 modules/sasl/scram.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'modules')

diff --git a/modules/sasl/scram.py b/modules/sasl/scram.py
index 8e5bb1fd..f73f39a4 100644
--- a/modules/sasl/scram.py
+++ b/modules/sasl/scram.py
@@ -1,7 +1,7 @@
-import base64, enum, hashlib, hmac, typing, uuid
+import base64, enum, hashlib, hmac, os, typing
 
 def _scram_nonce() -> bytes:
-    return uuid.uuid4().hex.encode("utf8")
+    return base64.b64encode(os.urandom(32))
 def _scram_escape(s: bytes) -> bytes:
     return s.replace(b"=", b"=3D").replace(b",", b"=2C")
 def _scram_unescape(s: bytes) -> bytes:
-- 
cgit v1.3.1-10-gc9f91