[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 15 Jun 2023 12:56:52 +0100
From: Brian McDermott <bmcdermott@...sus-labs.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-1672: race condition in Tang exposes private keys to other
processes
Hello all,
Tang (https://github.com/latchset/tang) is an open source project that
is used to bind data to network presence. It is commonly used along with
Clevis clients to provide for unattended LUKS decryption of server
storage volumes within the realms of a network, where a trusted Tang
server is situated.
CENSUS identified that the Tang software in versions 11, 12 and 13 (and
possibly previous versions) is vulnerable to a form of race condition,
where the Tang private keys become exposed for a small time window to
other users on the same host. The issue is tracked as CVE-2023-1672.
More information regarding the vulnerability can be found here:
https://census-labs.com/news/2023/06/15/race-tang/
Users are recommended to upgrade to Tang version 14 where the issue has
been sufficiently addressed.
Best regards,
Brian McDermott
--
Brian McDermott
Jr IT Security Professional Intern
Add: SYNGROU AVENUE 128, Athens 11745, Greece
Mob: +30 6944 435541
Tel: +30 210 2208989-90
https://census-labs.com -- IT Security Works
CONFIDENTIALITY NOTICE
The contents of this email message and any attachments are intended solely for the
addressee(s) and might contain confidential and/or privileged information and might
be legally protected from disclosure. If you are not the intended recipient of this
message or this message has been addressed to you in error, please immediately notify
the sender and delete any copies of it; you are hereby notified that any use, copying
or storage of this message or its attachments is strictly prohibited.
Download attachment "OpenPGP_0x68BA3525BB668B19.asc" of type "application/pgp-keys" (3156 bytes)
Download attachment "OpenPGP_signature" of type "application/pgp-signature" (841 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
