CVE-2014-3209

What it actually does

ldns-keygen creates private key files with permissions derived from the current umask instead of restrictive defaults, allowing other local users to read the key material.

Why it matters to the business

Exposure of private keys can let unauthorized local users decrypt traffic, impersonate services, or access protected resources, increasing risk of data breaches or service compromise; the packages remain present in container images despite the 2014 origin of the flaw.

How an attack unfolds

A local attacker waits for or triggers ldns-keygen execution, then reads the newly created private key file whose permissions were set too permissively by the active umask.

How to fix it

Upgrade hubble-ui (Chainguard) to 0.13.1-r4 or later, hubble-ui (Wolfi) to 0.13.1-r4 or later, hubble-ui-backend (Chainguard) to 0.13.1-r4 or later, and hubble-ui-backend (Wolfi) to 0.13.1-r4 or later; rebuild and redeploy affected images.

How to confirm the fix worked

Verify installed package versions match the fixed releases; after key generation, confirm private key files have mode 0600 or stricter regardless of umask.

Typical attack path

1. Identify a process or script that invokes ldns-keygen on the system or container
2. Trigger or observe key generation
3. Read the resulting private key file using standard file access
4. Use the obtained key material for further attacks such as decryption or authentication

How to detect it

Search filesystem or container layers for private key files created by ldns-keygen that have group or world readable permissions; inspect package manifests for vulnerable ldns versions; review process execution logs for ldns-keygen invocations followed by file access by non-owner users.

What your security team should do

• Immediately upgrade the listed packages to the specified fixed versions in all builds
• Scan container images and registries for older ldns-containing packages
• Add build-time checks that enforce restrictive umask or explicit chmod on generated keys
• Review any local processes that call ldns-keygen and ensure they run with safe umask settings