It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pki-javadocUpgrade pki-core-debuginfoUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-caUpgrade pki-tools | Aug 28, 2019 | Jul 26, 2018 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade pki-toolsUpgrade pki-symkeyUpgrade pki-javadocUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-baseUpgrade pki-kraUpgrade pki-ca | Oct 11, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-baseUpgrade pki-symkeyUpgrade pki-caUpgrade pki-kraUpgrade pki-serverUpgrade pki-tools | Oct 11, 2019 | Jul 26, 2018 |
| Oracle_linux | — | Upgrade pki-baseUpgrade pki-caUpgrade pki-kraUpgrade pki-javadocUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-base-java | Aug 9, 2017 | Jul 21, 2017 |
| Redhat_linux | — | Upgrade pki-symkeyUpgrade pki-kraUpgrade pki-baseUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade pki-caUpgrade pki-serverUpgrade pki-javadocUpgrade pki-base-java | Aug 4, 2017 | Aug 1, 2017 |
| Ubuntu | — | Upgrade pki-base-java (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-ca (Ubuntu Pro) | Dec 11, 2024 | Jul 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub