CVE-2023-1672 Race condition exists in the key generation and rotation functionality

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host...

CVE-2023-1672

The CVE-2023-1672 entry describes a race condition in Tang server key generation/rotation that could allow Tang private keys to be read by other processes on the same host. Connected advisories/plugins confirm Tang is affected across multiple Linux distributions (e.g., MiracleLinux tang-14-2.el9,...

CVE-2023-1672

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host...

CVE-2023-1672 Race condition exists in the key generation and rotation functionality

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host...

MAL-2023-426 Malicious code in fca-tpk05 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e686517998e98824fb4c4bde8bf891215eee0f0274b60fe8d5620402ec1953b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Tang 竞争条件问题漏洞

Tang is an open source server from latchset that binds data to the web. Tang suffers from a security vulnerability that stems from the presence of a competitive condition for key generation and key rotation, which can cause other processes on the same host to read the private key within a short...

MAL-2023-391 Malicious code in fca-dongdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb7e267d4770ed0eb30406e55aaa5ef9f11d1737106e559cfe828f9f6cbe00a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-205 Malicious code in confusion-1337 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d5e0f5fa705444941a3db8182bfc9c7eacb35a3bda7f57cccae5e088eb93404 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-300 Malicious code in ecorp-secret-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d0bf7826238a624701946507e61cf63dc75ea421397e13d125e2721546c812f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2023-1403 tang security update

This package is a server for binding data to network presence. First, the client gets a list of the Tang server's advertised asymmetric keys. This can happen online by a simple HTTP GET. Alternatively, since the keys are asymmetric, the public key list can be distributed out of band. Second, the...

Secrets, Secrets Are No Fun. Secrets, Secrets (Stored in Plain Text Files) Hurt Someone

Secrets are meant to be hidden or, at the very least, only known to a specific and limited set of individuals or systems. Otherwise, they aren't really secrets. In personal life, a secret revealed can damage relationships, lead to social stigma, or, at the very least, be embarrassing. In a...

MAL-2023-525 Malicious code in ing-feat-lu-luxtrust-oaw-authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0429c78b1da16f9685e08f78ad467a0be68e7b2496e9693f6a25aafaf9057e66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora 38 : tang (2023-3e84bba241)

The remote Fedora 38 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-3e84bba241 advisory. Fixes CVE-2023-1672 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

Fedora 37 : tang (2023-eb9bec6e8c)

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-eb9bec6e8c advisory. Fixes CVE-2023-1672 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not teste...

MAL-2023-295 Malicious code in dvknpm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09a696d8c3c377146d4b73291c04e8c3d8db8b531883f7ca49f9c473a3eea080 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-1672

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host...

PT-2023-7323 · Unknown +5 · Tang Server +5

Name of the Vulnerable Software and Affected Versions: Tang server affected versions not specified Description: A race condition exists in the Tang server functionality for key generation and key rotation, resulting in a small time window where Tang private keys become readable by other processes...

MAL-2023-363 Malicious code in fc-phone-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec30fba8ba38ae5e354c219234fb4dd78d71537718394caf3d584e896c5b0a42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-365 Malicious code in fc-scroll (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7f4167da0bf5409b53f5b683dcdb962d93b6d03e2d9e3916c5859f78f8f9f1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-342 Malicious code in fc-date (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d8d6bb92a710835f8785839506932483d23f3a9efba0b3a5ac06dec1c2b133a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...