The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the…
Priority LOW 11CWE-264Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- Will not fix Red Hat: no fix planned
Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-264.
Summary
The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.
Why it matters now
EPSS 0.00376 31st percentileScored 2026-11-07
Fix Will not fix Red Hat: no fix planned
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 12
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:nlnetlabs:ldns:1.6.0:*:*:*:*:*:*:* | 1.6.0 | Vulnerable | NLNETLABS |
| cpe:2.3:a:nlnetlabs:ldns:1.6.1:*:*:*:*:*:*:* | 1.6.1 | Vulnerable | NLNETLABS |
| cpe:2.3:a:nlnetlabs:ldns:1.6.2:*:*:*:*:*:*:* | 1.6.2 | Vulnerable | NLNETLABS |
| cpe:2.3:a:nlnetlabs:ldns:1.6.3:*:*:*:*:*:*:* | 1.6.3 | Vulnerable | NLNETLABS |
| cpe:2.3:a:nlnetlabs:ldns:1.6.4:*:*:*:*:*:*:* | 1.6.4 | Vulnerable | NLNETLABS |
| cpe:2.3:a:nlnetlabs:ldns:1.6.5:*:*:*:*:*:*:* | 1.6.5 | Vulnerable | NLNETLABS |
| cpe:2.3:a:nlnetlabs:ldns:1.6.6:*:*:*:*:*:*:* | 1.6.6 | Vulnerable | NLNETLABS |
| cpe:2.3:a:nlnetlabs:ldns:1.6.7:*:*:*:*:*:*:* | 1.6.7 | Vulnerable | NLNETLABS |
| cpe:2.3:a:nlnetlabs:ldns:1.6.8:*:*:*:*:*:*:* | 1.6.8 | Vulnerable | NLNETLABS |
| cpe:2.3:a:nlnetlabs:ldns:1.6.9:*:*:*:*:*:*:* | 1.6.9 | Vulnerable | NLNETLABS |
- cpe:2.3:a:nlnetlabs:ldns:1.6.0:*:*:*:*:*:*:* Versions 1.6.0 Vulnerable ·NLNETLABS
- cpe:2.3:a:nlnetlabs:ldns:1.6.1:*:*:*:*:*:*:* Versions 1.6.1 Vulnerable ·NLNETLABS
- cpe:2.3:a:nlnetlabs:ldns:1.6.2:*:*:*:*:*:*:* Versions 1.6.2 Vulnerable ·NLNETLABS
- cpe:2.3:a:nlnetlabs:ldns:1.6.3:*:*:*:*:*:*:* Versions 1.6.3 Vulnerable ·NLNETLABS
- cpe:2.3:a:nlnetlabs:ldns:1.6.4:*:*:*:*:*:*:* Versions 1.6.4 Vulnerable ·NLNETLABS
- cpe:2.3:a:nlnetlabs:ldns:1.6.5:*:*:*:*:*:*:* Versions 1.6.5 Vulnerable ·NLNETLABS
- cpe:2.3:a:nlnetlabs:ldns:1.6.6:*:*:*:*:*:*:* Versions 1.6.6 Vulnerable ·NLNETLABS
- cpe:2.3:a:nlnetlabs:ldns:1.6.7:*:*:*:*:*:*:* Versions 1.6.7 Vulnerable ·NLNETLABS
- cpe:2.3:a:nlnetlabs:ldns:1.6.8:*:*:*:*:*:*:* Versions 1.6.8 Vulnerable ·NLNETLABS
- cpe:2.3:a:nlnetlabs:ldns:1.6.9:*:*:*:*:*:*:* Versions 1.6.9 Vulnerable ·NLNETLABS
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Will not fix |
Timeline
- 2026-10-02 Threatist record created from CVE-2014-3209
- 2026-10-03 Alias added: GHSA-cc58-7rpr-73mr
References
More NLNETLABS Ldns vulnerabilities
- TI-2017-14547 A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors. CVSS 3.0CRITICAL 9.8
- TI-2017-14548 A double-free vulnerability in str2host.c in ldns 1.7.0 have unspecified impact and attack vectors. CVSS 3.0CRITICAL 9.8
- TI-2011-03157 Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns before… CVSS 2.0MEDIUM 6.8
- TI-2020-13719 When a zone file in ldns 1.7.1 is parsed, the function ldns_nsec3_salt_data is too… CVSS 3.1HIGH 7.5
- TI-2026-09311 Insufficient verification that responses belong to a query CVSS 4.0HIGH 8.2
- TI-2009-01040 Heap-based buffer overflow in the ldns_rr_new_frm_str_internal function in ldns 1.4.x… CVSS 2.0MEDIUM 6.4
Sources
- CVE-2014-3209 · CVE Program
- CVE-2014-3209 · NVD
- FIRST EPSS
- GHSA-cc58-7rpr-73mr · GitHub Advisory Database · CC BY 4.0
- CVE-2014-3209 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences