Bug 1111474

Summary:	softhsm: softhsm-keyconv's output files are world-readable
Product:	[Other] Security Response	Reporter:	Murray McAllister <mmcallis>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED CURRENTRELEASE	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	carnil, pwouters
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	softhsm 2.0.0b1	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-08-22 06:22:39 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1111475, 1111476
Bug Blocks:

Description Murray McAllister 2014-06-20 06:41:32 UTC

The softhsm-keyconv utility can convert BIND private keys to the PKCS#8 format and vice versa. It was reported the softhsm-keyconv created output files (the converted keys) with world-readable permissions. A local, unprivileged user on a system running DNSSEC could use this flaw to obtain DNSSEC keys, if softhsm-keyconv was used to create the converted file in a directory the unprivileged user has access to.

References:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=752092
https://issues.opendnssec.org/browse/SUPPORT-136

CVE request:
http://www.openwall.com/lists/oss-security/2014/06/20/4

Comment 1 Murray McAllister 2014-06-20 06:43:02 UTC

Created softhsm tracking bugs for this issue:

Affects: fedora-all [bug 1111475]
Affects: epel-6 [bug 1111476]

Comment 2 Vincent Danen 2014-09-11 13:41:16 UTC

This is corrected in 2.0.0b1, as per the NEWS:

SoftHSM 2.0.0b1 - 2014-09-10
...
* SUPPORT-136: softhsm2-keyconv creates files with sensitive material
  in insecure way.

and the commit:

https://github.com/bellgrim/SoftHSMv2/commit/492447cd4a2be449e99fb9ad2519ea3277aaad28

Comment 5 Vincent Danen 2015-08-22 06:23:20 UTC

Fedora contains 2.0.0b1 now.