Description
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Certificate System 7 | pkisetup | 7.3.0-14.el4 | RHSA-2009:0007 |
| Red Hat Certificate System 7 | rhpki-ca | 7.3.0-17.el4 | RHSA-2009:0007 |
| Red Hat Certificate System 7 | rhpki-common | 7.3.0-40.el4 | RHSA-2009:0007 |
| Red Hat Certificate System 7 | rhpki-kra | 7.3.0-13.el4 | RHSA-2009:0007 |
| Red Hat Certificate System 7 | rhpki-ocsp | 7.3.0-11.el4 | RHSA-2009:0007 |
| Red Hat Certificate System 7 | rhpki-ra | 7.3.0-67.el4 | RHSA-2009:0007 |
| Red Hat Certificate System 7 | rhpki-tks | 7.3.0-12.el4 | RHSA-2009:0007 |
| Red Hat Certificate System 7 | rhpki-tps | 7.3.0-23.el4 | RHSA-2009:0007 |
| Red Hat Certificate System 7 | rhpki-util | 7.3.0-20.el4 | RHSA-2009:0007 |
Advisories 1
- RHSA-2009:0007 Red Hat Security Advisory: rhpki security and bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- 33508 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=475998
- redhat-cs-tps-security-bypass(48331) vdb-entry
- ADV-2009-0145 vdb-entry
- RHSA-2009:0007 vendor-advisory
- 33693 third-party-advisory