INFCSA-2023:6492: tang security update

Information about definition

Identificator: INFCSA-2023:6492

Type: security

Release date: 2025-09-24 19:55:57 UTC

Information about package

Tang is a server for binding data to network presence. It includes a daemon which provides cryptographic operations for binding to a remote service. The tang package provides the server side of the Network Bound Disk Encryption (NBDE) project.

Vulnerabilities description

  • CVE-2023-1672

    A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.

Severity level

CVE Score CVSS 2.0 Score CVSS 3.x Score CVSS 4.0
NIST — CVE-2023-1672
 no information 5.3 no information
Critical, important, moderate, low

Updated packages

loader icon Preparing to download...
Architecture: Download