CVE-2023-1672 — Race condition exists in the key generation and rotation functionality

Affected: tang, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Fedora

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.

USN-6489-1 — tang vulnerability

Affected: Ubuntu:Pro:18.04:LTS: tang, Ubuntu:20.04:LTS: tang, Ubuntu:22.04:LTS: tang

Brian McDermott discovered that Tang incorrectly handled permissions when creating/rotating keys. A local attacker could possibly use this issue to read the keys.

Most recent entries from all

CVE-2023-1672 — Race condition exists in the key generation and rotation functionality

USN-6489-1 — tang vulnerability