It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pki-baseUpgrade pki-symkeyUpgrade pki-caUpgrade pki-toolsUpgrade pki-kraUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-core-debuginfoUpgrade pki-javadoc | Aug 28, 2019 | Jul 26, 2018 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade pki-caUpgrade pki-baseUpgrade pki-kraUpgrade pki-serverUpgrade pki-javadocUpgrade pki-toolsUpgrade pki-base-javaUpgrade pki-symkey | Oct 11, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-baseUpgrade pki-kraUpgrade pki-serverUpgrade pki-caUpgrade pki-symkeyUpgrade pki-tools | Oct 11, 2019 | Jul 26, 2018 |
| Oracle_linux | — | Upgrade pki-kraUpgrade pki-baseUpgrade pki-caUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-javadocUpgrade pki-base-javaUpgrade pki-tools | Aug 9, 2017 | Jul 21, 2017 |
| Redhat_linux | — | Upgrade pki-kraUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade pki-toolsUpgrade pki-caUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-javadoc | Aug 4, 2017 | Aug 1, 2017 |
| Ubuntu | — | Upgrade pki-server (Ubuntu Pro)Upgrade pki-base-java (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-ca (Ubuntu Pro) | Dec 11, 2024 | Jul 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub