Medium USN-6489-1 1 CVE

tang vulnerability

Published Nov 20, 2023 · Updated Feb 10, 2026

Ecosystem: Ubuntu

Summary

Brian McDermott discovered that Tang incorrectly handled permissions when
creating/rotating keys. A local attacker could possibly use this issue to
read the keys.

Fixed packages 3

Release	Package	Fixed in
Ubuntu · 20.04 LTS 20.04:LTS	tang	7-1ubuntu0.2
Ubuntu · 22.04 LTS 22.04:LTS	tang	11-1ubuntu0.1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS	tang	6-1ubuntu0.1~esm1

Vulnerabilities 1

Medium 5.3

CVE-2023-1672

Race condition exists in the key generation and rotation functionality

A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.

Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux

Jul 11, 2023

References

report
https://ubuntu.com/security/CVE-2023-1672