The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade pki-toolsUpgrade pki-serverUpgrade pki-core-debuginfoUpgrade pki-baseUpgrade pki-caUpgrade pki-base-javaUpgrade pki-symkeyUpgrade pki-kraUpgrade pki-javadoc | Jul 5, 2018 | Jun 26, 2018 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Jul 3, 2018 |
| Oracle_linux | — | Upgrade pki-caUpgrade pki-toolsUpgrade pki-javadocUpgrade pki-symkeyUpgrade pki-base-javaUpgrade pki-baseUpgrade pki-serverUpgrade pki-kra | Jul 21, 2020 | Mar 15, 2018 |
| Redhat_linux | — | Upgrade pki-base-javaUpgrade pki-javadocNo solution existsUpgrade pki-baseUpgrade pki-toolsUpgrade pki-caUpgrade pki-kraUpgrade pki-serverUpgrade pki-symkeyUpgrade pki-core-debuginfo | Jun 27, 2018 | Jun 26, 2018 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub