Description
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | pki-core | pki-core versions 10.12.4 and prior are affected. | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | dogtag-pki | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 20.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 18.04 LTS | dogtag-pki | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dogtag-pki | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | pki-core +9 | 11.3.0-1.el9 | RHSA-2023:2293 |
| RHEL 7 | pki-ca +8 | 10.5.18-23.el7_9 | RHSA-2022:7086 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8.6 EUS | jss +1 | 4.9.3-1.module+el8.6.0+14244+60d461b7 | RHSA-2023:3394 |
| RHEL 8.6 EUS | ldapjdk +1 | 4.23.0-1.module+el8.5.0+11983+6ba118b4 | RHSA-2023:3394 |
| RHEL 8.6 EUS | pki-ca +9 | 10.12.7-1.module+el8.6.0+18623+dea80f17 | RHSA-2023:3394 |
| RHEL 8.6 EUS | tomcatjss | 7.7.1-1.module+el8.6.0+13291+248751b1 | RHSA-2023:3394 |
| Red Hat Certificate System 9 | pki-tks +3 | 10.5.18-23.el7pki | RHSA-2022:7077 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | idm-pki-ca +8 | 11.3.0-1.el9 | ALSA-2023:2293 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | pki-ca +7 | 10.5.18-27.amzn2.0.1 | ALAS2-2023-2304 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | idm-jss +1 | 5.3.0-1.el9 | ELSA-2023-2293 |
| Oracle Linux 9 | idm-pki-ca +8 | 11.3.0-1.0.1.el9 | ELSA-2023-2293 |
| Oracle Linux 9 | idm-tomcatjss | 8.3.0-1.el9 | ELSA-2023-2293 |
| Oracle Linux 7 | pki-ca +7 | 10.5.18-23.el7_9 | ELSA-2022-7086 |
Advisories 9
- ALSA-2023:2293 Moderate: pki-core security, bug fix, and enhancement update AlmaLinux Security Advisories · Oct 29, 2026
- RHSA-2022:7086 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2023:3394 Red Hat Security Advisory: pki-core:10.6 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2023:2293 Red Hat Security Advisory: pki-core security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2022:7077 Red Hat Security Advisory: Red Hat Certificate System 9.7 CVE bug fix update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ALAS2-2023-2304 Moderate: pki-core security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Oct 19, 2023
- WID-SEC-2022-0706 Red Hat Enterprise Linux: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 19, 2023
- ELSA-2023-2293 Moderate: pki-core security, bug fix, and enhancement update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · May 15, 2023
- ELSA-2022-7086 Moderate: pki-core security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 24, 2022