A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade python2-ipaserverUpgrade ipa-admintoolsUpgrade ipa-server-dnsUpgrade python2-ipaclientUpgrade ipa-server-trust-adUpgrade ipa-client-commonUpgrade ipa-python-compatUpgrade ipa-commonUpgrade ipa-server-commonUpgrade ipa-serverUpgrade ipa-debuginfoUpgrade python2-ipalibUpgrade ipa-client | Mar 6, 2017 | Mar 2, 2017 |
| Oracle_linux | — | Upgrade python2-ipaclientUpgrade ipa-python-compatUpgrade ipa-server-trust-adUpgrade python2-ipalibUpgrade ipa-server-commonUpgrade ipa-server-dnsUpgrade ipa-client-commonUpgrade ipa-admintoolsUpgrade ipa-commonUpgrade python2-ipaserverUpgrade ipa-serverUpgrade ipa-client | Mar 3, 2017 | Feb 27, 2017 |
| Redhat_linux | — | Upgrade python2-ipaserverUpgrade ipa-admintoolsUpgrade python2-ipaclientUpgrade ipa-server-dnsUpgrade ipa-server-trust-adUpgrade ipa-server-commonUpgrade ipa-client-commonUpgrade ipa-debuginfoUpgrade ipa-serverUpgrade python2-ipalibUpgrade ipa-commonUpgrade ipa-python-compatUpgrade ipa-client | Mar 3, 2017 | Mar 2, 2017 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub