CVE-2023-1672: Race condition exists in the key generation and rotation functionality
A race condition exists in the Tang server functionality for key generation and key rotation, which results in a small time window where Tang private keys become readable by other processes on the same host.
References:
https://bugzilla.redhat.com/showbug.cgi?id=2180990
Other sources
A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/tangto a version that resolves this vulnerability.Fixed in 14.1
Event History
Frequently Asked Questions
What is CVE-2023-1672?
CVE-2023-1672 is a vulnerability that exists in the Tang server functionality for key generation and key rotation, allowing Tang private keys to become readable by other processes on the same host.
What is the severity of CVE-2023-1672?
The severity of CVE-2023-1672 is medium with a CVSS score of 5.3.
Which software is affected by CVE-2023-1672?
The Tang server functionality in tang_project:tang up to version 14, fedoraproject:fedora version 38, redhat:enterprise_linux version 8.0, and redhat:enterprise_linux version 9.0 are affected by CVE-2023-1672.
How can I fix CVE-2023-1672?
You can fix CVE-2023-1672 by updating the Tang server software to a version that addresses the race condition vulnerability.
Where can I find more information about CVE-2023-1672?
You can find more information about CVE-2023-1672 on the Red Hat Security Advisory and the Openwall mailing list.