tang: CVE-2023-1672

Debian Bug report logs - #1038119
tang: CVE-2023-1672

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: tang: CVE-2023-1672

Date: Thu, 15 Jun 2023 17:53:13 +0200

Source: tang
Version: 11-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil@debian.org, Debian Security Team <team@security.debian.org>

Hi,

The following vulnerability was published for tang.

CVE-2023-1672[0]:
| Fix race condition when creating/rotating keys


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2023-1672
    https://www.cve.org/CVERecord?id=CVE-2023-1672
[1] https://github.com/latchset/tang/commit/8dbbed10870378f1b2c3cf3df2ea7edca7617096

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

Message #10 received at 1038119@bugs.debian.org (full text, mbox, reply):

From: Christoph Biedl <debian.axhn@manchmal.in-ulm.de>

To: Salvatore Bonaccorso <carnil@debian.org>, 1038119@bugs.debian.org

Subject: Re: Bug#1038119: tang: CVE-2023-1672

Date: Thu, 15 Jun 2023 20:04:41 +0200

[Message part 1 (text/plain, inline)]

Salvatore Bonaccorso wrote...

> CVE-2023-1672[0]:
> | Fix race condition when creating/rotating keys
> 
> Please adjust the affected versions in the BTS as needed.

As I'm very short of time today, first in words only:

* Debian sid will see a new upstream version (containing the fixes)
  in the next hours.
* Debian 12 ("bookworm") and 11 ("Bullseye") will be fixed via an
  upcoming point release.
* Debian 10 ("buster") is *not* affected, tight permissions of the
  directory holding the keys were asserted.

Regards,

    Christoph

[signature.asc (application/pgp-signature, inline)]

Send a report that this bug log contains spam.