A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade python2-ipaserverUpgrade ipa-server-dnsUpgrade ipa-server-trust-adUpgrade python2-ipaclientUpgrade ipa-admintoolsUpgrade ipa-server-commonUpgrade ipa-serverUpgrade ipa-clientUpgrade ipa-python-compatUpgrade ipa-debuginfoUpgrade ipa-commonUpgrade python2-ipalibUpgrade ipa-client-common | Mar 6, 2017 | Mar 2, 2017 |
| Oracle_linux | — | Upgrade python2-ipalibUpgrade ipa-client-commonUpgrade ipa-admintoolsUpgrade ipa-python-compatUpgrade python2-ipaclientUpgrade ipa-server-commonUpgrade ipa-server-dnsUpgrade ipa-server-trust-adUpgrade python2-ipaserverUpgrade ipa-commonUpgrade ipa-clientUpgrade ipa-server | Mar 3, 2017 | Feb 27, 2017 |
| Redhat_linux | — | Upgrade python2-ipaserverUpgrade ipa-admintoolsUpgrade python2-ipaclientUpgrade ipa-python-compatUpgrade ipa-server-trust-adUpgrade ipa-client-commonUpgrade python2-ipalibUpgrade ipa-clientUpgrade ipa-commonUpgrade ipa-serverUpgrade ipa-debuginfoUpgrade ipa-server-dnsUpgrade ipa-server-common | Mar 3, 2017 | Mar 2, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub