In the event the PRNG hasn't been sufficiently seeded and $RANDFILE points to an invalid file (for instance), any failure that occurs on line 405 in https_init will be ignored.
The call should be checked to ensure that the PRNG is indeed properly seeded by duo_unix -- otherwise crypto guarantees could be invalidated by the weakness.
In the event the PRNG hasn't been sufficiently seeded and
$RANDFILEpoints to an invalid file (for instance), any failure that occurs on line 405 inhttps_initwill be ignored.The call should be checked to ensure that the PRNG is indeed properly seeded by duo_unix -- otherwise crypto guarantees could be invalidated by the weakness.
Reported by Coverity.
https://github.com/duosecurity/duo_unix/blob/5ca4f5ad728fef20e04606dcd12ee5b949693f04/lib/https.c#L405