Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Fri, 20 Jun 2014 16:15:14 +1000
From: Murray McAllister <>
Subject: Re: CVE request: softhsm, softhsm-keyconv tool creates
 world-readable files

On 06/20/2014 04:02 PM, Salvatore Bonaccorso wrote:
> Hello Murray,
> (keeping the Cc on the bureport to answer this also there):
> On Fri, Jun 20, 2014 at 03:46:30PM +1000, Murray McAllister wrote:
> [...]
>> The Debian bug also notes a similar issue was fixed in ldns - I've
>> asked for more details about that in the bug).
> This should be CVE-2014-3209 (dns-keygen generates keys with world
> readable permissions ).
> Regards,
> Salvatore


Regarding the rndc impact I noted, it seems the softhsm-keyconv is
dnssec related, not the type of keys you would use in a rndc.key file...

Murray McAllister / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.