It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pki-kraUpgrade pki-serverUpgrade pki-base-javaUpgrade pki-javadocUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade pki-toolsUpgrade pki-caUpgrade pki-symkey | Aug 28, 2019 | Jul 26, 2018 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp1 | — | Upgrade pki-toolsUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-javadocUpgrade pki-symkeyUpgrade pki-baseUpgrade pki-caUpgrade pki-kra | Oct 11, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-baseUpgrade pki-serverUpgrade pki-kraUpgrade pki-symkeyUpgrade pki-caUpgrade pki-tools | Oct 11, 2019 | Jul 26, 2018 |
| Oracle_linux | — | Upgrade pki-javadocUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-serverUpgrade pki-toolsUpgrade pki-caUpgrade pki-kraUpgrade pki-base | Aug 9, 2017 | Jul 21, 2017 |
| Redhat_linux | — | Upgrade pki-serverUpgrade pki-javadocUpgrade pki-base-javaUpgrade pki-caUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-kra | Aug 4, 2017 | Aug 1, 2017 |
| Ubuntu | — | Upgrade pki-base-java (Ubuntu Pro)Upgrade pki-server (Ubuntu Pro)Upgrade pki-ca (Ubuntu Pro)Upgrade dogtag-pki (Ubuntu Pro)Upgrade pki-base (Ubuntu Pro) | Dec 11, 2024 | Jul 26, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub