CVE-2010-2450

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-11-07 · updated 2026-06-16
Weakness: CWE-200

Description

The keygen.sh script in Shibboleth SP 2.0 (located in /usr/local/etc/shibboleth by default) uses OpenSSL to create a DES private key which is placed in sp-key.pm. It relies on the root umask (default 22) instead of chmoding the resulting file itself, so the generated private key is world readable by default.

Affected products

Debian Linux: 8.0, 9.0
Shibboleth Service Provider: 2.0

References

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=571631
https://security-tracker.debian.org/tracker/CVE-2010-2450
https://todos.internet2.edu/browse/SSPCPP-106
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=571631
https://security-tracker.debian.org/tracker/CVE-2010-2450
https://todos.internet2.edu/browse/SSPCPP-106

Get alerted when CVE-2010-2450 or the next vulnerability affects your stack