Ubuntu Security Notices
USN-6489-1

USN-6489-1: Tang vulnerability

Publication date

20 November 2023

Overview

Tang could allow unintended access to secret keys.

Releases

23.04 22.04 LTS 20.04 LTS 18.04 LTS

Packages

tang - network-based cryptographic binding server

Details

Brian McDermott discovered that Tang incorrectly handled permissions when
creating/rotating keys. A local attacker could possibly use this issue to
read the keys.

Update instructions

In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release	Package Version
23.04 lunar	tang-common – 11-2ubuntu0.1
22.04 jammy	tang-common – 11-1ubuntu0.1
20.04 focal	tang – 7-1ubuntu0.2
18.04 bionic	tang – 6-1ubuntu0.1~esm1

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

CVE-2023-1672

CVE-2023-1672