RLSA-2023:7022: Moderate: tang security and bug fix update

Q: Which systems are exposed to this issue?

Systems running the Tang server component are affected. Tang provides server-side cryptographic operations for Network Bound Disk Encryption deployments.

Q: What would an attacker need to exploit the vulnerability?

The CVSS vector indicates adjacent-network access is required, exploitation has high attack complexity, and no privileges or user interaction are required.

Q: What is the security impact if exploitation succeeds?

The advisory rates the issue as medium severity with a CVSS score of 5.3. Its vector indicates high confidentiality impact, with no integrity or availability impact.

Q: What component should be updated?

Update the tang package on Rocky Linux systems. The security fix addresses a race condition in Tang key generation and rotation functionality, tracked as CVE-2023-1672.

Published Nov 5, 2026

Updated

Tang is a server for binding data to network presence. It includes a daemon which provides cryptographic operations for binding to a remote service. The tang package provides the server side of the Network Bound Disk Encryption (NBDE) project.

Security Fix(es):

tang: Race condition exists in the key generation and rotation functionality (CVE-2023-1672)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.9 Release Notes linked from the References section.

Affected Software

1 affected componentFixes available

rocky-linux/tang<0:7-8.el8

0:7-8.el8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rocky-linux/tang to a version that resolves this vulnerability.
Fixed in 0:7-8.el8

Event History

Nov 5, 2026

Advisory Published

via OSV·12:01 PM

Data Sourced

via OSV·12:01 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2023-1672

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running the Tang server component are affected. Tang provides server-side cryptographic operations for Network Bound Disk Encryption deployments.

What would an attacker need to exploit the vulnerability?

The CVSS vector indicates adjacent-network access is required, exploitation has high attack complexity, and no privileges or user interaction are required.

What is the security impact if exploitation succeeds?

The advisory rates the issue as medium severity with a CVSS score of 5.3. Its vector indicates high confidentiality impact, with no integrity or availability impact.

What component should be updated?

Update the tang package on Rocky Linux systems. The security fix addresses a race condition in Tang key generation and rotation functionality, tracked as CVE-2023-1672.

RLSA-2023:7022: Moderate: tang security and bug fix update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which systems are exposed to this issue?

What would an attacker need to exploit the vulnerability?

What is the security impact if exploitation succeeds?

What component should be updated?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What would an attacker need to exploit the vulnerability?

What is the security impact if exploitation succeeds?

What component should be updated?