Description
Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Certificate System 7 | pkisetup | 7.2.0-7 | RHSA-2009:0007, RHSA-2009:0006 |
| Red Hat Certificate System 7 | rhpki-ca | 7.2.0-6 | RHSA-2009:0007, RHSA-2009:0006 |
| Red Hat Certificate System 7 | rhpki-common | 7.2.0-16 | RHSA-2009:0007, RHSA-2009:0006 |
| Red Hat Certificate System 7 | rhpki-kra +2 | 7.2.0-5 | RHSA-2009:0007, RHSA-2009:0006 |
| Red Hat Certificate System 7 | rhpki-ra | 7.3.0-67.el4 | RHSA-2009:0007 |
| Red Hat Certificate System 7 | rhpki-tps | 7.2.0-8 | RHSA-2009:0007, RHSA-2009:0006 |
| Red Hat Certificate System 7 | rhpki-util | 7.3.0-20.el4 | RHSA-2009:0007 |
Advisories 2
- RHSA-2009:0007 Red Hat Security Advisory: rhpki security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2009:0006 Red Hat Security Advisory: rhpki security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- https://bugzilla.redhat.com/show_bug.cgi?id=451998
- 33540 third-party-advisory
- ADV-2009-0145 vdb-entry
- 33288 vdb-entry
- 1021608 vdb-entry
- RHSA-2009:0006 vendor-advisory
- RHSA-2009:0007 vendor-advisory
- redhat-cs-configfile-info-disclosure(48021) vdb-entry