[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 20 Jun 2014 16:15:14 +1000
From: Murray McAllister <mmcallis@...hat.com>
To: oss-security@...ts.openwall.com
CC: 752092@...s.debian.org, carnil@...ian.org
Subject: Re: CVE request: softhsm, softhsm-keyconv tool creates
world-readable files
On 06/20/2014 04:02 PM, Salvatore Bonaccorso wrote:
> Hello Murray,
>
> (keeping the Cc on the bureport to answer this also there):
>
> On Fri, Jun 20, 2014 at 03:46:30PM +1000, Murray McAllister wrote:
> [...]
>> The Debian bug also notes a similar issue was fixed in ldns - I've
>> asked for more details about that in the bug).
>
> This should be CVE-2014-3209 (dns-keygen generates keys with world
> readable permissions ).
>
> Regards,
> Salvatore
>
Thanks!
Regarding the rndc impact I noted, it seems the softhsm-keyconv is
dnssec related, not the type of keys you would use in a rndc.key file...
--
Murray McAllister / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
