Date: Fri, 20 Jun 2014 16:15:14 +1000 From: Murray McAllister <mmcallis@...hat.com> To: oss-security@...ts.openwall.com CC: 752092@...s.debian.org, carnil@...ian.org Subject: Re: CVE request: softhsm, softhsm-keyconv tool creates world-readable files On 06/20/2014 04:02 PM, Salvatore Bonaccorso wrote: > Hello Murray, > > (keeping the Cc on the bureport to answer this also there): > > On Fri, Jun 20, 2014 at 03:46:30PM +1000, Murray McAllister wrote: > [...] >> The Debian bug also notes a similar issue was fixed in ldns - I've >> asked for more details about that in the bug). > > This should be CVE-2014-3209 (dns-keygen generates keys with world > readable permissions ). > > Regards, > Salvatore > Thanks! Regarding the rndc impact I noted, it seems the softhsm-keyconv is dnssec related, not the type of keys you would use in a rndc.key file... -- Murray McAllister / Red Hat Product Security
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.