A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content.
CVSS Details
- CVSS 3.1 Base Score: 5.7
- CVSS 3.1 Vector: (CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | alma-upgrade-idm-pki-acmealma-upgrade-idm-pki-basealma-upgrade-idm-pki-caalma-upgrade-idm-pki-estalma-upgrade-idm-pki-javaalma-upgrade-idm-pki-kraalma-upgrade-idm-pki-serveralma-upgrade-idm-pki-toolsalma-upgrade-python3-idm-pki | May 15, 2023 | Jul 14, 2022 | |
| Amazon Linux Ami 2 | amazon-linux-ami-2-upgrade-pki-baseamazon-linux-ami-2-upgrade-pki-base-javaamazon-linux-ami-2-upgrade-pki-caamazon-linux-ami-2-upgrade-pki-core-debuginfoamazon-linux-ami-2-upgrade-pki-javadocamazon-linux-ami-2-upgrade-pki-kraamazon-linux-ami-2-upgrade-pki-serveramazon-linux-ami-2-upgrade-pki-symkeyamazon-linux-ami-2-upgrade-pki-tools | Oct 23, 2023 | Jul 14, 2022 | |
| Centos_linux | — | centos-upgrade-idm-jsscentos-upgrade-idm-jss-debuginfocentos-upgrade-idm-ldapjdkcentos-upgrade-idm-pki-acmecentos-upgrade-idm-pki-basecentos-upgrade-idm-pki-cacentos-upgrade-idm-pki-estcentos-upgrade-idm-pki-javacentos-upgrade-idm-pki-kracentos-upgrade-idm-pki-servercentos-upgrade-idm-pki-toolscentos-upgrade-idm-tomcatjsscentos-upgrade-jss-debugsourcecentos-upgrade-pki-basecentos-upgrade-pki-base-javacentos-upgrade-pki-cacentos-upgrade-pki-core-debuginfocentos-upgrade-pki-javadoccentos-upgrade-pki-kracentos-upgrade-pki-servercentos-upgrade-pki-symkeycentos-upgrade-pki-toolscentos-upgrade-python3-idm-pki | Oct 25, 2022 | Jul 14, 2022 |
| Debian | no-fix-debian-deb-package | May 15, 2025 | Jul 14, 2022 | |
| Oracle_linux | — | oracle-linux-upgrade-idm-jssoracle-linux-upgrade-idm-ldapjdkoracle-linux-upgrade-idm-pki-acmeoracle-linux-upgrade-idm-pki-baseoracle-linux-upgrade-idm-pki-caoracle-linux-upgrade-idm-pki-estoracle-linux-upgrade-idm-pki-javaoracle-linux-upgrade-idm-pki-kraoracle-linux-upgrade-idm-pki-serveroracle-linux-upgrade-idm-pki-toolsoracle-linux-upgrade-idm-tomcatjssoracle-linux-upgrade-pki-baseoracle-linux-upgrade-pki-base-javaoracle-linux-upgrade-pki-caoracle-linux-upgrade-pki-javadocoracle-linux-upgrade-pki-kraoracle-linux-upgrade-pki-serveroracle-linux-upgrade-pki-symkeyoracle-linux-upgrade-pki-toolsoracle-linux-upgrade-python3-idm-pki | Oct 25, 2022 | Jul 12, 2022 |
| Redhat_linux | redhat-upgrade-idm-jssredhat-upgrade-idm-jss-debuginforedhat-upgrade-idm-ldapjdkredhat-upgrade-idm-pki-acmeredhat-upgrade-idm-pki-baseredhat-upgrade-idm-pki-caredhat-upgrade-idm-pki-estredhat-upgrade-idm-pki-javaredhat-upgrade-idm-pki-kraredhat-upgrade-idm-pki-serverredhat-upgrade-idm-pki-toolsredhat-upgrade-idm-tomcatjssredhat-upgrade-jssredhat-upgrade-jss-debuginforedhat-upgrade-jss-debugsourceredhat-upgrade-jss-javadocredhat-upgrade-ldapjdkredhat-upgrade-ldapjdk-javadocredhat-upgrade-pki-acmeredhat-upgrade-pki-baseredhat-upgrade-pki-base-javaredhat-upgrade-pki-caredhat-upgrade-pki-core-debuginforedhat-upgrade-pki-core-debugsourceredhat-upgrade-pki-javadocredhat-upgrade-pki-kraredhat-upgrade-pki-serverredhat-upgrade-pki-symkeyredhat-upgrade-pki-symkey-debuginforedhat-upgrade-pki-toolsredhat-upgrade-pki-tools-debuginforedhat-upgrade-python3-idm-pkiredhat-upgrade-python3-pkiredhat-upgrade-tomcatjss | Oct 25, 2022 | Jul 14, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub