It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pki-kraUpgrade pki-core-debuginfoUpgrade pki-javadocUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-caUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-tools | Aug 28, 2019 | Jul 26, 2018 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade pki-caUpgrade pki-baseUpgrade pki-kraUpgrade pki-javadocUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-tools | Oct 11, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-toolsUpgrade pki-symkeyUpgrade pki-caUpgrade pki-kraUpgrade pki-serverUpgrade pki-base | Oct 11, 2019 | Jul 26, 2018 |
| Oracle_linux | — | Upgrade pki-caUpgrade pki-baseUpgrade pki-kraUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-javadocUpgrade pki-serverUpgrade pki-base-java | Aug 9, 2017 | Jul 21, 2017 |
| Redhat_linux | — | Upgrade pki-caUpgrade pki-toolsUpgrade pki-baseUpgrade pki-symkeyUpgrade pki-core-debuginfoUpgrade pki-kraUpgrade pki-javadocUpgrade pki-serverUpgrade pki-base-java | Aug 4, 2017 | Aug 1, 2017 |
| Ubuntu | — | Upgrade pki-ca (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade pki-base-java (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro) | Dec 11, 2024 | Jul 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub