CVE-2010-2450: Infoleak

Published Nov 7, 2019

Updated

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.

Affected Software

4 affected componentsFixes available

shibboleth Service Provider=2.0

Debian Debian Linux=8.0

Debian Debian Linux=9.0

debian/shibboleth-sp

3.2.2+dfsg1-13.2.2+dfsg1-1+deb11u13.4.1+dfsg-2+deb12u13.5.0+dfsg-2+deb13u13.5.2+dfsg-1

Remediation

Patch Available

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=571631

Event History

Nov 7, 2019

CVE Published

via MITRE·08:06 PM

Data Sourced

via MITRE·08:06 PM

Description

Feb 17, 2026

Data Sourced

via Debian·09:50 PM

DescriptionAffected Software

Frequently Asked Questions

What is the vulnerability ID?

The vulnerability ID is CVE-2010-2450.

What is the severity of CVE-2010-2450?

The severity of CVE-2010-2450 is high with a score of 7.5.

How does the keygen.sh script in Shibboleth SP 2.0 create a private key?

The keygen.sh script in Shibboleth SP 2.0 uses OpenSSL to create a DES private key.

Where is the generated private key placed?

The generated private key is placed in sp-key.pm.

Is the generated private key world readable?

Yes, the generated private key is world readable.

What is the affected software?

The affected software is Shibboleth Service Provider 2.0 and Debian Debian Linux 8.0 and 9.0.

How can I fix CVE-2010-2450?

You can fix CVE-2010-2450 by updating to version 3.0.4+dfsg1-1+deb10u2 or higher for Debian or applying the necessary updates for Shibboleth Service Provider.