CVE-2010-2450

Name	CVE-2010-2450
Description	The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs	571631

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
shibboleth-sp (PTS)	buster, buster (security)	3.0.4+dfsg1-1+deb10u2	fixed
	bullseye	3.2.2+dfsg1-1	fixed
	bookworm, sid	3.4.1+dfsg-2	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
shibboleth-sp	source	(unstable)	(not affected)
shibboleth-sp2	source	(unstable)	2.3.1+dfsg-2	low		571631

[lenny] - shibboleth-sp2 <no-dsa> (Minor issue)
- shibboleth-sp <not-affected> (Vulnerable code not present)