CVE-2023-1672

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.
Race Condition
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.3 MEDIUM
ADJACENT_NETWORK
HIGH
NONE
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
redhatCNA
5.3 MEDIUM
ADJACENT_NETWORK
HIGH
NONE
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
CVEADP
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 4%
VendorProductVersion
tang_projecttang
𝑥
< 14
redhatenterprise_linux
8.0
redhatenterprise_linux
9.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
tang
bullseye
8-3+deb11u2
fixed
bullseye (security)
vulnerable
bookworm
11-2+deb12u1
fixed
sid
15-2
fixed
trixie
15-2
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
tang
mantic
not-affected
lunar
Fixed 11-2ubuntu0.1
released
kinetic
ignored
jammy
Fixed 11-1ubuntu0.1
released
focal
Fixed 7-1ubuntu0.2
released
bionic
Fixed 6-1ubuntu0.1~esm1
released
xenial
ignored
trusty
ignored
Common Weakness Enumeration
References
https://access.redhat.com/security/cve/CVE-2023-1672
https://bugzilla.redhat.com/show_bug.cgi?id=2180999
https://github.com/latchset/tang/commit/8dbbed10870378f1b2c3cf3df2ea7edca7617096
https://lists.debian.org/debian-lts-announce/2023/11/msg00004.html
https://www.openwall.com/lists/oss-security/2023/06/15/1
https://access.redhat.com/security/cve/CVE-2023-1672
https://bugzilla.redhat.com/show_bug.cgi?id=2180999
https://github.com/latchset/tang/commit/8dbbed10870378f1b2c3cf3df2ea7edca7617096
https://lists.debian.org/debian-lts-announce/2023/11/msg00004.html
https://www.openwall.com/lists/oss-security/2023/06/15/1