CVE-2001-1467: mkpasswd in expect 5.2.8, as used by Red Hat Linux 6.2 through 7.0, seeds its random number generator with...

Security readout for executives and security teams

This issue concerns weak password generation, not remote code execution. Red Hat Linux 6.2 through 7.0 used mkpasswd from expect 5.2.8, which seeded randomness with a process ID. That reduced possible password combinations, making brute-force guessing easier if those generated passwords remained in use. Exposure is likely limited to environments that used affected mkpasswd output on Red Hat Linux 6.2 through 7.0 or equivalent expect 5.2.8 deployments. The lasting risk is accounts or service credentials originally generated by this tool and never rotated. Treat this as a legacy credential-risk issue. It is not presented as actively exploited, but credentials generated by the flawed tool may remain weak until rotated. Prioritize where old Red Hat systems or long-lived service passwords exist. Mitigation focus: Identify systems that used Red Hat Linux 6.2 through 7.0 mkpasswd.; Rotate passwords or secrets generated by affected mkpasswd versions.; Use vendor-supported password generation tools with strong randomness..

Prepared

Jun 29, 2026, 22:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.