Security report- Server Private keys disclosed #107721
Labels
No Label
Interest
Alembic
Interest
Animation & Rigging
Interest
Asset Browser
Interest
Asset Browser Project Overview
Interest
Audio
Interest
Automated Testing
Interest
Blender Asset Bundle
Interest
BlendFile
Interest
Collada
Interest
Compatibility
Interest
Compositing
Interest
Core
Interest
Cycles
Interest
Dependency Graph
Interest
Development Management
Interest
EEVEE
Interest
EEVEE & Viewport
Interest
Freestyle
Interest
Geometry Nodes
Interest
Grease Pencil
Interest
ID Management
Interest
Images & Movies
Interest
Import Export
Interest
Line Art
Interest
Masking
Interest
Metal
Interest
Modeling
Interest
Modifiers
Interest
Motion Tracking
Interest
Nodes & Physics
Interest
OpenGL
Interest
Overlay
Interest
Overrides
Interest
Performance
Interest
Physics
Interest
Pipeline, Assets & IO
Interest
Platforms, Builds & Tests
Interest
Python API
Interest
Render & Cycles
Interest
Render Pipeline
Interest
Sculpt, Paint & Texture
Interest
Text Editor
Interest
Translations
Interest
Triaging
Interest
Undo
Interest
USD
Interest
User Interface
Interest
UV Editing
Interest
VFX & Video
Interest
Video Sequencer
Interest
Virtual Reality
Interest
Vulkan
Interest
Wayland
Interest
Workbench
Interest: X11
Legacy
Blender 2.8 Project
Legacy
Milestone 1: Basic, Local Asset Browser
Legacy
OpenGL Error
Meta
Good First Issue
Meta
Papercut
Meta
Retrospective
Meta
Security
Module
Animation & Rigging
Module
Core
Module
Development Management
Module
EEVEE & Viewport
Module
Grease Pencil
Module
Modeling
Module
Nodes & Physics
Module
Pipeline, Assets & IO
Module
Platforms, Builds & Tests
Module
Python API
Module
Render & Cycles
Module
Sculpt, Paint & Texture
Module
Triaging
Module
User Interface
Module
VFX & Video
Platform
FreeBSD
Platform
Linux
Platform
macOS
Platform
Windows
Priority
High
Priority
Low
Priority
Normal
Priority
Unbreak Now!
Status
Archived
Status
Confirmed
Status
Duplicate
Status
Needs Info from Developers
Status
Needs Information from User
Status
Needs Triage
Status
Resolved
Type
Bug
Type
Design
Type
Known Issue
Type
Patch
Type
Report
Type
To Do
No Milestone
No project
No Assignees
2 Participants
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: blender/blender#107721
Loading…
Reference in New Issue
No description provided.
Delete Branch "%!s(<nil>)"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Hello,
Hello Team,
With reference of your security responsible program , I found RSA server private keys that are leak in the given end point of the link.
STEPS TO REPRODUCE
Open the given link below so you will see RSA keys leak as given .
https://www.projects.blender.org/archive/flamenco-manager/src/branch/master/tls/privkey.pem
IMPACT
If an Attacker obtain these key he could used to encrypt and decrypt secret information. The compromised key can be used to decrypt encrypted data without the knowledge of the sender of the data. These keys should be restricted from the Public.
PROOF OF CONCEPT
-----BEGIN PRIVATE KEY-----
MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDlKODDD8Pmm9dk
uAwqbrMN/bQDd3GeXWtj75Y4GYLr/qCXxRFtme53Y0sr65j6pMLWRvTdZ2c96yEc
7qEqARtXPOoQtrHRSX3Dxn9THHebsiTTH0cSHUhgdSVIM6DLBimYjh38GkVS5gv5
PVj2CAYFdw1iVR+XbDnDNAN6rR3NXO2tZDEq17Ea0p/SdjIDMAE+zzsBOO3Y8vOZ
Nm2Jzu2qR6AahqRLTwjRxjppzIgXj1LvzxmDEq6r4OLcgKkrXbTXjEBb+AaUjpu3
GMjGdzSmPWc6LpW9fw+TBSGJ66bMltcu5fd4GT7i9xE5U3VwSrlSh1Lsi4JDHStA
/XjgqBPjAgMBAAECggEBAL6aJ4hW3ow65wbBBm1sscVbVZTkjj44WZA/wORcY8bC
fPR/VyWgOPZYQjf/t7gRvnTXg+d7kCWyIlKcMLRtQz5mThEkw/XdeJuTyGdqcBmy
LGrlwwlQDdkc1qudNYpoT8SxwELl3u86pI7j9dB9j/SPtzQotSQPQmQYKSSqRPV/
WDUG3vBAoMQaUXHZqN9+ryeWYP4CYZZKF1NxxomkFg4Y+M6s6G+7NIeYmTTTrQWB
xxYJnTIDFaK0S9uEn7qsELhCsSMENbEEm6+wmi9uFemYhsQeXsVrOuGw1rTtbeHB
QANfL5zUCuOT+tVoy0sT/6u6UOD9jeMlc13uBl7H+wECgYEA/8mLrlbgz68gLzXq
rkqGCCuHChFsJU1A+APMv+myoUTd4gXupBdfLS9k72CbKfBwUniWJgplyRU0gZT5
YqCT+cLjBfYkzmKEZUMOSYlpSEtej3ma19Bbmxzh4pJWQtV5hLkujs2Sir4SN/i+
8ncYtnDOTD0V0UDlB88Q0gmcM0ECgYEA5Vmp4q9yg0hsDXXqrb+irl0q8Hjov2AM
bXRTh7gMvtPR/Ra8lJY+Th542K59+deDe5/mNrdLsVQDX4ro74yyGfcHlNLGYFM0
UTPXDaubJYyOYfHwsEeU3KHj+XFjbTFc+l8aN1g4DMkVvHAoAMV7aYlf2SlxDoKr
JonEIUCSkiMCgYEAtD7sRVBHX1KDFYGi/GrbhEpYAIpCcQ69Z4gV8m7WR7pluO6B
OfSWRxsMv3qOHMGoBRWgiPHuxAJDW8UE77FEVU41+G95hE38Cfd0y/Ee1aj225fP
u6DBzM5Phv+j9bjExvhPjKXkTAygffy1Ydr2+SkI1sR86VYXjqclrTzEa4ECgYEA
kRvm8ebhxBB5VRbrMZ1TF5EZDubhE9x4YHQ+OVuIrOAmN0RAcp6QsypyeV4FlKL3
rKshpDLasEqgi72+3XmeYfE7Gb02CFH8gvgSs7KEygAhQfUqvM29cM75B6TnLHoU
AtFTK/skE2rS1tP7a2mHSOHDBApFXtHr6ck2j3dkhRMCgYBP6iQT6SoEZKT1P4Te
bcVkCgSl0D1GvALds8BcEWfUL4X7x54QWeU4CgiNLnwHnf+R4pIcXiQs5NAXwZiG
eMqPYUCOG6KjkLIxMPP4ghMbI2ZCjPE0oLquwsyMurD8ClZ5vP+WQjxu8gv+ak63
qqjUgar6faW8Yomhz6v0md+pXw==
-----END PRIVATE KEY-----
Hi @SYED-MUHAMMAD-ASIM .
Thanks for letting us know. Next time, please take the responsible route and contact us slightly more privately, instead of writing a publicly readable report with a link to the private key and a copy of that key.
What you found is not a security issue, though. It's just a self-signed certificate for
localhostthat's useful for development purposes (as you can see in https://projects.blender.org/archive/flamenco-manager/src/branch/master/tls/cert.pem). This key was never used in any deployment of Flamenco by Blender Institute.