PT-2023-7323 · Unknown+6 · Tang Server+6

Brian Mcdermott · Publicado 2023-06-07 · Atualizado 2025-01-20 · CVE-2023-1672

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tang server (affected versions not specified)

Description A race condition exists in the Tang server functionality for key generation and key rotation, resulting in a small time window where Tang private keys become readable by other processes on the same host. This issue is related to errors in synchronization when using a shared resource.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Enumeração de Fraquezas

CWE-362

Identificadores relacionados

ALSA-2023:6492

ALSA-2023:7022

ALT-PU-2023-7560

AZL-27405

BDU:2023-08353

CESA-2023_7022

CVE-2023-1672

DLA-3648-1

INFSA-2023_6492

OESA-2023-1403

RHSA-2023:6492

RHSA-2023:7022

RHSA-2023_6492

RHSA-2023_7022

ROSA-SA-2023-2295

USN-6489-1

Produtos afetados

Alt Linux

Almalinux

Centos

Linuxmint

Red Hat

Tang Server

Ubuntu

Referências · 34

• 🔥 https://openwall.com/lists/oss-security/2023/06/15/1 · Exploit
• https://github.com/latchset/tang/commit/8dbbed10870378f1b2c3cf3df2ea7edca7617096 · Correção
• https://github.com/latchset/tang/pull/123/commits/05b12d14f7945b898235558af0bbaa43c582ccdd · Nota
• https://osv.dev/vulnerability/ALSA-2023:7022 · Aviso do Fabricante
• https://bugzilla.redhat.com/2180999 · Nota
• https://access.redhat.com/errata/RHSA-2023:6492 · Nota
• https://osv.dev/vulnerability/OESA-2023-1403 · Aviso do Fabricante
• https://errata.msvsphere-os.ru/definition/9/INFCSA-2023:6492?lang=ru · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1672 · Nota de Segurança
• https://access.redhat.com/security/cve/CVE-2023-1672 · Nota
• https://t.me/cibsecurity/66366 · Publicação no Telegram
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-1672 · Aviso do Fabricante
• https://osv.dev/vulnerability/AZL-27405 · Aviso do Fabricante
• https://linux.oracle.com/errata/ELSA-2023-6492.html · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-1672 · Aviso do Fabricante