The bug in 4.0.0 is this which was fixed in 4.0.1. It had nothing to do with the entropy bug that already existed in 4.0.0
// 4.0.0
bool ckcc_vcp_enabled = true;
// 4.0.1
bool ckcc_vcp_enabled; // defaults false
Login to reply
Replies (6)
According to CCs security advisory the "current" entropy bug exists from 4.0.1 on
So basically they fixed the chcc bug present in 4.0.0 but introduced de TRNG bug 🙈🙈
This is exactly the situation why I opted not to update my CC to the newest version, hot fixes are risky business
@ODELL you have any additional info on this?!
@HODL spread?
If the above was the only bug why did Odell's guide make make users not vulnerable?
@HODL answer why odell's guide protects users from this then?
Where did the screenshot come from?
My understanding is the bug was introduced in 4.0.0
The confusion comes from the fact that since they patched a bug in that version, they removed it from the list of releases instead of keeping it and adding a "THIS IS A VULNERABLE VERSION" disclaimer.
Therefore people see that the first version released after 3.x.x was 4.0.1 and assume that this was where the bug was introduced.