CVE-2010-2450

2019-11-0720:06:05

mitre

www.cve.org

EPSS

0.007

Percentile

80.9%

JSON

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.