A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade ipa-debuginfoUpgrade ipa-client-commonUpgrade python2-ipalibUpgrade ipa-clientUpgrade ipa-python-compatUpgrade ipa-server-commonUpgrade ipa-commonUpgrade ipa-serverUpgrade ipa-server-dnsUpgrade python2-ipaserverUpgrade python2-ipaclientUpgrade ipa-admintoolsUpgrade ipa-server-trust-ad | Mar 6, 2017 | Mar 2, 2017 |
| Oracle_linux | — | Upgrade ipa-serverUpgrade ipa-commonUpgrade python2-ipaserverUpgrade ipa-clientUpgrade ipa-server-dnsUpgrade ipa-server-trust-adUpgrade python2-ipaclientUpgrade ipa-admintoolsUpgrade python2-ipalibUpgrade ipa-python-compatUpgrade ipa-client-commonUpgrade ipa-server-common | Mar 3, 2017 | Feb 27, 2017 |
| Redhat_linux | — | Upgrade python2-ipaserverUpgrade ipa-admintoolsUpgrade python2-ipaclientUpgrade ipa-python-compatUpgrade ipa-server-commonUpgrade ipa-commonUpgrade ipa-clientUpgrade ipa-server-trust-adUpgrade ipa-server-dnsUpgrade ipa-debuginfoUpgrade python2-ipalibUpgrade ipa-serverUpgrade ipa-client-common | Mar 3, 2017 | Mar 2, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub