[
https://issues.apache.org/jira/browse/CAMEL-24447?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24447:
-------------------------------------
Fix Version/s: 4.22.1
4.18.5
> camel-pqc - FileBasedKeyLifecycleManager writes private keys with default
> file permissions
> ------------------------------------------------------------------------------------------
>
> Key: CAMEL-24447
> URL: https://issues.apache.org/jira/browse/CAMEL-24447
> Project: Camel
> Issue Type: Bug
> Components: camel-pqc
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.22.1, 4.23.0, 4.18.5
>
>
> {{FileBasedKeyLifecycleManager.storeKey()}} writes {{<keyId>.private.json}} -
> a Base64 PKCS#8 private key in plain JSON - with {{Files.writeString}} and no
> permission restriction. The constructor creates the key directory the same
> way, and {{migrateLegacyKey()}} re-stores legacy keys into the same layout.
> Under the common {{022}} umask the directory and the private-key files end up
> world-readable.
> Proposal: create the directory with {{PosixFilePermissions}} {{rwx------}}
> and the key files {{rw-------}} where the file system supports POSIX
> permissions, falling back to {{File.setReadable(false, false)}} /
> {{setWritable(false, false)}} elsewhere, and verify the permissions after
> creation rather than assuming the umask cooperated. Existing files created by
> an earlier version should be tightened on load, or at least warned about.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
