24 results · Feed
-
High 8.1
Pki-core: dogtag-pki: redhat-pki: pki: est fullcmc authentication bypass allows certificate mis-issuance with arbitrary subject
A flaw was found in Dogtag PKI (pki-core). The CMCAuthForEST authentication plugin fails open when an EST fullcmc enrollment request is submitted via BasicAuth without an end-user TLS client certificate. The SSL_CLIENT_CERT session attribute retains the EST s…
-
High 8.1
Pki-core: dogtag pki v2 rest acl filter's reverse-lexicographic tie-break lets a ca agent invoke the admin-only raw profile creation endpoint
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific …
-
High 7.2
Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges c…
-
Medium 5.3
Pki-core: dogtag-pki: unauthenticated dogtag ca rest api exposes security domain hosts
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requir…
-
Medium 5.8
Dogtag-pki: pki-core: redhat-pki: pki: acme http-01 validation ssrf via ip literal identifiers and unvalidated redirects
A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can …
-
Medium 6.5
Dogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slash
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authenti…
-
Low 3.1
Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to …
-
High 7.5
Ca: token authentication bypass vulnerability
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, wh…
-
Unscored —
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows …
-
Unscored —
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-ba…
-
Unscored —
A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in th…
-
Unscored —
A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scr…
-
Unscored —
A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly saniti…
-
Unscored —
A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corre…
-
Unscored —
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation.…
-
Low 2.4
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly san…
-
Medium 4.6
A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sa…
-
Medium 4.3
A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not…
-
Medium 4.3
A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from …
-
Medium 4.6
It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, …
-
Medium 4.7
A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to …
-
Medium 5.9
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the p…
-
High 7.5
Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes th…
-
Unscored —
Multiple temporary file creation vulnerabilities in pki-core 10.2.0.