Description
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Certificate System 8 | pki-ca | 8.0.7-1.el5pki | RHSA-2010:0838 |
| Red Hat Certificate System 8 | pki-common +1 | 8.0.6-2.el5pki | RHSA-2010:0838 |
| Red Hat Certificate System 8 | pki-util +1 | 8.0.5-1.el5pki | RHSA-2010:0838 |
| Red Hat Certificate System 7 | rhpki-ca +1 | 7.3.0-21.el4 | RHSA-2010:0837 |
| Red Hat Certificate System 7 | rhpki-common | 7.3.0-41.el4 | RHSA-2010:0837 |
Advisories 2
- RHSA-2010:0838 Red Hat Security Advisory: pki security and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2010:0837 Red Hat Security Advisory: rhpki security and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
References
- RHSA-2010:0837 vendor-advisory
- 69149 vdb-entry
- https://bugzilla.redhat.com/show_bug.cgi?id=648882
- RHSA-2010:0838 vendor-advisory
- 1024697 vdb-entry
- https://fedorahosted.org/pki/changeset/1261
- 42181 third-party-advisory