CVE-2021-4076 — Sensitive Information Exposure in Project Tang

CWE-200 — Sensitive Information Exposure6 documents6 sources
Severity
7.5HIGHNVD
EPSS
0.5%
top 35.03%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Tang Project Tang
Timeline
PublishedMar 2
Latest updateMar 4

Description

A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDtang_project/tang8 — 11
▶Debiantang_project/tang< 8-3+deb11u1+3
▶CVEListV5tang_project/tangAffects tang v8 and above | Fixed in tang v11.

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-83f4-c2vq-g2p3: A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys↗2022-03-04
▶
OSV
CVE-2021-4076: A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys↗2022-03-02
▶
CVEList
CVE-2021-4076: A flaw exists in tang, a network-based cryptographic binding server, which could result in leak of private keys↗2022-03-02
▶

📋Vendor Advisories

2
Red Hat
tang: private key leak↗2021-12-07
▶
Debian
CVE-2021-4076: tang - A flaw exists in tang, a network-based cryptographic binding server, which could...↗2021
▶
CVE-2021-4076 — Sensitive Information Exposure | cvebase