CVE-2023-1672

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.

References

Affected packages

Debian:11 / tang

Package

Name: tang
Purl: pkg:deb/debian/tang?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

8-3+deb11u2

Affected versions

Other

8-3

8-3+deb11u1

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / tang

Package

Name: tang
Purl: pkg:deb/debian/tang?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

11-2+deb12u1

Affected versions

Other

11-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / tang

Package

Name: tang
Purl: pkg:deb/debian/tang?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

14-1

Affected versions

Other

11-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/latchset/tang

Affected ranges

Type: GIT
Repo: https://github.com/latchset/tang
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

8dbbed10870378f1b2c3cf3df2ea7edca7617096

Fixed

8dbbed10870378f1b2c3cf3df2ea7edca7617096

Affected versions

Other

v10

v11

v12

v13