According to CCs security advisory the "current" entropy bug exists from 4.0.1 on
So basically they fixed the chcc bug present in 4.0.0 but introduced de TRNG bug 🙈🙈
This is exactly the situat...
If they say from 4.0.1 onwards it's because 4.0.0 was never officially released.
"Version 4.0.0 was built, signed, and tested internally, but its binary was never released publicly. The contemporaneous signing manifest records that internal build and does not indicate public distribution. Firmware 4.0.1 was the first public 4.x binary, so public users were not exposed to this regression."
The entropy bug existed in 4.0.0, I checked the commits. It was not added between 4.0.0 to 4.0.1.
"Version 4.0.0 was built, signed, and tested internally, but its binary was never released publicly. The contemporaneous signing manifest records that internal build and does not indicate public distribution. Firmware 4.0.1 was the first public 4.x binary, so public users were not exposed to this regression."
The entropy bug existed in 4.0.0, I checked the commits. It was not added between 4.0.0 to 4.0.1.
👍1
