PT-2023-7323 · Unknown+6 · Tang Server+6

Brian Mcdermott · Published 2023-06-07 · Updated 2025-01-20 · CVE-2023-1672

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Tang server (affected versions not specified)

Description A race condition exists in the Tang server functionality for key generation and key rotation, resulting in a small time window where Tang private keys become readable by other processes on the same host. This issue is related to errors in synchronization when using a shared resource.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALSA-2023:6492

ALSA-2023:7022

ALT-PU-2023-7560

AZL-27405

BDU:2023-08353

CESA-2023_7022

CVE-2023-1672

DLA-3648-1

INFSA-2023_6492

OESA-2023-1403

RHSA-2023:6492

RHSA-2023:7022

RHSA-2023_6492

RHSA-2023_7022

ROSA-SA-2023-2295

USN-6489-1

Affected Products

Alt Linux

Almalinux

Centos

Linuxmint

Red Hat

Tang Server

Ubuntu

References · 34

• 🔥 https://openwall.com/lists/oss-security/2023/06/15/1 · Exploit
• https://github.com/latchset/tang/commit/8dbbed10870378f1b2c3cf3df2ea7edca7617096 · Patch
• https://osv.dev/vulnerability/ALSA-2023:7022 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2023-1403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1672 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-1672 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-27405 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2023-6492.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-1672 · Vendor Advisory
• https://osv.dev/vulnerability/USN-6489-1 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3648-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-1672 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2180999 · Patch
• https://cve.org/CVERecord?id=CVE-2023-1672 · Security Note
• https://ubuntu.com/security/notices/USN-6489-1 · Vendor Advisory