{"id":"CVE-2014-3209","aliases":["DEBIAN-CVE-2014-3209","EUVD-2014-3227","GHSA-cc58-7rpr-73mr","MGASA-2014-0212","UBUNTU-CVE-2014-3209","USN-3491-1"],"status":"published","title":"The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private...","description":"The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.","severity":{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00376,"percentile":0.31825,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264"],"published":"2014-05-10T19:38:37Z","modified":"2026-10-23T15:47:29Z","fixes":[{"ecosystem":"Debian:12","package":"ldns","fixed_in":["1.6.17-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ldns","fixed_in":["1.6.17-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ldns","fixed_in":["1.6.17-4"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"ldns","fixed_in":["1.6.16-2.1.mga3"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"ldns","fixed_in":["1.6.16-3.1.mga4"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"ldns","fixed_in":["1.6.17-1ubuntu0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-4"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16-2.1.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.16-3.1.mga4"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-1ubuntu0.1"}]}],"versions":["1.6.16-1","1.6.17-1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-1ubuntu0.1"}]}],"versions":["1.6.16-1","1.6.17-1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ldns","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.17-8ubuntu0.1"}]}],"versions":["1.6.17-5","1.6.17-7","1.6.17-8"],"bundled":3}],"products":[{"vendor":"nlnetlabs","product":"ldns"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2014/05/03/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=746758","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://www.nlnetlabs.nl/bugs-script/show_bug.cgi?id=573","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.openwall.com/lists/oss-security/2014/05/05/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/67200","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3209"},{"url":"https://github.com/advisories/GHSA-cc58-7rpr-73mr"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3209","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0212.html","tags":["advisory"]},{"url":"http://openwall.com/lists/oss-security/2014/05/05/4","tags":["web"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13324","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3209","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-3491-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3209","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000231","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2017-1000232","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-3209","description":"The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.","status":"published","published":"2014-11-16T01:00:00Z","modified":"2024-08-06T10:35:56.989Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-3227","description":"The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.","status":"published","published":"2014-11-16T01:00:00Z","modified":"2024-08-06T10:35:56Z","updated_at":"2026-11-03T01:57:11.825115Z"}],"ghsa":[{"id":"GHSA-cc58-7rpr-73mr","title":"The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private...","description":"The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.","status":"published","published":"2022-05-17T04:21:33Z","modified":"2023-01-28T05:01:43Z","updated_at":"2026-11-02T14:43:37.013144Z"}],"nvd":[{"id":"CVE-2014-3209","description":"The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.","status":"published","published":"2014-11-16T01:59:03.163Z","modified":"2026-06-17T00:07:48.537Z","cvss":[{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:57.304171Z"}],"osv":[{"id":"CVE-2014-3209","description":"The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.","status":"published","published":"2014-11-16T01:59:03Z","modified":"2026-04-16T06:24:10.366991746Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3209","description":"The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.","status":"published","published":"2014-11-16T01:59:03.163Z","modified":"2026-10-23T15:47:29.75989916Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0212","title":"Updated ldns package fixes CVE-2014-3209","description":"Updated ldns packages fix security vulnerability:\n\nldns-keygen creates a private key with the default permissions according\nto the users umask, which in most cases will cause the private key to be\nworld-readable (CVE-2014-3209).\n","status":"published","published":"2014-05-10T19:38:37Z","modified":"2026-04-16T06:25:53.243275087Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-3209","description":"The ldns-keygen tool in ldns 1.6.x uses the current umask to set the privileges of the private key, which might allow local users to obtain the private key by reading the file.","status":"published","published":"2014-11-15T00:00:00Z","modified":"2026-04-22T09:38:13.205569Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-3491-1","title":"ldns vulnerabilities","description":"Leon Weber discovered that the ldns-keygen tool incorrectly set permissions\non private keys. A local attacker could possibly use this issue to obtain\ngenerated private keys. This issue only applied to Ubuntu 14.04 LTS.\n(CVE-2014-3209)\n\nStephan Zeisberg discovered that ldns incorrectly handled memory when\nprocessing data. A remote attacker could use this issue to cause ldns to\ncrash, resulting in a denial of service, or possibly execute arbitrary\ncode. (CVE-2017-1000231, CVE-2017-1000232)\n","status":"published","published":"2017-11-22T18:15:23Z","modified":"2026-04-22T09:41:04.223077Z","updated_at":"2026-11-02T16:58:13.496563Z"}]}}