CVE-2010-2450

State: Published
Severity: Not scored
Published: Nov 7, 2019
Updated: Aug 7, 2024
Reserved: Jun 24, 2010

Description

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://security-tracker.debian.org/tracker/CVE-2010-2450
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=571631
https://todos.internet2.edu/browse/SSPCPP-106

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.