X509 store: Private key leak via inherited file descriptor
Affects x509-storeSource GCVE Database
Rated Medium by Threat Radar's AI analysis
- Patch
- Available – fixed in 1.6.12
Data as of 13 Nov 2026, 19:14 UTC
What to do
Upgrade crypton-x509-store to 1.6.12.
Patches and advisories
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Hackagex509-store | Affected
| Fixed in– |
| Hackagecrypton-x509-store | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
A patch is available and fixed the vulnerability in version 1.6.12 by setting the close-on-exec flag on Unix-based systems. Users should upgrade to version 1.6.12 or later to remediate this issue.
Description
A vulnerability in the X.509 key reading function 'readKeyFile' allowed private key file descriptors to be inherited by child processes due to the absence of the close-on-exec flag. This could lead to private key leakage if untrusted child processes do not close inherited descriptors. The issue was fixed by setting the close-on-exec flag on Unix-based systems.