CVE-2013-4442: Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavaila...

Security readout for executives and security teams

Pwgen before 2.07 could generate weaker passwords if /dev/urandom was unavailable. That can reduce password unpredictability and make some generated passwords easier to guess. The issue is most relevant where older pwgen was used to create operational or user passwords under degraded entropy conditions. Exposure is likely limited to hosts or build/provisioning workflows using pwgen before 2.07. Risk is higher if generated passwords protected long-lived accounts, services, backups, or secrets, and if /dev/urandom could be unavailable when passwords were created. Treat this as a targeted hygiene issue, not an emergency without evidence of exploitation. Prioritize systems where pwgen generated important long-lived passwords, then upgrade and rotate affected secrets where reasonable. Mitigation focus: Upgrade pwgen to 2.07 or a vendor-fixed package.; Follow applicable Fedora, Mageia, Mandriva, or distribution vendor advisories.; Rotate passwords generated by vulnerable pwgen in high-value contexts..

Prepared

Jun 14, 2026, 05:41 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.