Description
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | keycloak | < 11.5.1 | 11.5.1 |
| Red Hat | Red Hat Certificate System 10.4 EUS for RHEL-8 | — | — |
| Red Hat | Red Hat Enterprise Linux 7 | — | — |
| Red Hat | Red Hat Enterprise Linux 8 | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | — | — |
| Red Hat | Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 8.8 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 9 | — | — |
| Red Hat | Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions | — | — |
| Red Hat | Red Hat Enterprise Linux 9.2 Extended Update Support | — | — |
| Red Hat | Red Hat Enterprise Linux 6 | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | dogtag-pki | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 22.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 20.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 18.04 LTS | dogtag-pki | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | dogtag-pki | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9 | pki-core +9 | 11.5.0-2.el9_4 | RHSA-2024:4165 |
| RHEL 8 | jss +2 | 4.11.0-1.module+el8.10.0+21280+cce842b8 | RHSA-2024:4367 |
| RHEL 8 | ldapjdk +2 | 4.24.0-1.module+el8.10.0+21280+cce842b8 | RHSA-2024:4367 |
| RHEL 8 | pki-core +9 | 10.15.1-1.module+el8.10.0+21991+2e8cd757 | RHSA-2024:4367 |
| RHEL 8 | resteasy +1 | 3.0.26-7.module+el8.10.0+21132+79720f4e | RHSA-2024:4367 |
| RHEL 8 | tomcatjss +1 | 7.8.0-1.module+el8.10.0+21280+cce842b8 | RHSA-2024:4367 |
| RHEL 7 | pki-ca +8 | 10.5.18-32.el7_9 | RHSA-2024:4222 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 9.2 EUS | pki-core +9 | 11.3.0-2.el9_2 | RHSA-2024:4051 |
| RHEL 9.0 E4S | pki-ca +9 | 11.0.6-3.el9_0 | RHSA-2024:4413 |
| RHEL 8.8 EUS | jss +1 | 4.9.4-1.module+el8.7.0+15532+95bac9ee | RHSA-2024:4179 |
| RHEL 8.8 EUS | ldapjdk +1 | 4.23.0-1.module+el8.5.0+11983+6ba118b4 | RHSA-2024:4179 |
| RHEL 8.8 EUS | pki-core +9 | 10.14.3-2.module+el8.8.0+21626+a79c8682 | RHSA-2024:4179 |
| RHEL 8.8 EUS | tomcatjss | 7.7.1-1.module+el8.6.0+13291+248751b1 | RHSA-2024:4179 |
| RHEL 8.6 TUS | jss +1 | 4.9.3-1.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 TUS | ldapjdk +1 | 4.23.0-1.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 TUS | pki-ca +9 | 10.12.7-2.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 TUS | tomcatjss | 7.7.1-1.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 E4S | jss +1 | 4.9.3-1.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 E4S | ldapjdk +1 | 4.23.0-1.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 E4S | pki-ca +9 | 10.12.7-2.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 E4S | tomcatjss | 7.7.1-1.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 AUS | jss +1 | 4.9.3-1.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 AUS | ldapjdk +1 | 4.23.0-1.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 AUS | pki-ca +9 | 10.12.7-2.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.6 AUS | tomcatjss | 7.7.1-1.module+el8.6.0+21627+1e66fa4f | RHSA-2024:4403 |
| RHEL 8.4 TUS | jss +1 | 4.8.1-2.module+el8.4.0+10451+3e5b5448 | RHSA-2024:4164 |
| RHEL 8.4 TUS | ldapjdk +1 | 4.22.0-1.module+el8.3.0+6784+6e1e4c62 | RHSA-2024:4164 |
| RHEL 8.4 TUS | pki-ca +9 | 10.10.5-7.module+el8.4.0+21628+7a16280d | RHSA-2024:4164 |
| RHEL 8.4 TUS | tomcatjss | 7.6.1-1.module+el8.4.0+8778+d07929ff | RHSA-2024:4164 |
| RHEL 8.4 E4S | jss +1 | 4.8.1-2.module+el8.4.0+10451+3e5b5448 | RHSA-2024:4164 |
| RHEL 8.4 E4S | ldapjdk +1 | 4.22.0-1.module+el8.3.0+6784+6e1e4c62 | RHSA-2024:4164 |
| RHEL 8.4 E4S | pki-ca +9 | 10.10.5-7.module+el8.4.0+21628+7a16280d | RHSA-2024:4164 |
| RHEL 8.4 E4S | tomcatjss | 7.6.1-1.module+el8.4.0+8778+d07929ff | RHSA-2024:4164 |
| RHEL 8.4 AUS | jss +1 | 4.8.1-2.module+el8.4.0+10451+3e5b5448 | RHSA-2024:4164 |
| RHEL 8.4 AUS | ldapjdk +1 | 4.22.0-1.module+el8.3.0+6784+6e1e4c62 | RHSA-2024:4164 |
| RHEL 8.4 AUS | pki-ca +9 | 10.10.5-7.module+el8.4.0+21628+7a16280d | RHSA-2024:4164 |
| RHEL 8.4 AUS | tomcatjss | 7.6.1-1.module+el8.4.0+8778+d07929ff | RHSA-2024:4164 |
| Red Hat Certificate System Eus 10 | idm-console-framework | 1.3.0-1.module+el8pki+14677+1ef79a68 | RHSA-2024:4070 |
| Red Hat Certificate System Eus 10 | jss +1 | 4.9.10-1.module+el8pki+21949+4b2d0700 | RHSA-2024:4070 |
| Red Hat Certificate System Eus 10 | ldapjdk +1 | 4.23.0-1.module+el8pki+14677+1ef79a68 | RHSA-2024:4070 |
| Red Hat Certificate System Eus 10 | redhat-pki +17 | 10.13.11-1.module+el8pki+21949+4b2d0700 | RHSA-2024:4070 |
| Red Hat Certificate System Eus 10 | tomcatjss | 7.7.4-1.module+el8pki+21738+33a5e23b | RHSA-2024:4070 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 9 | idm-pki-ca +8 | 11.5.0-2.el9_4.alma.1 | ALSA-2024:4165 |
| AlmaLinux 8 | idm-jss +1 | 4.11.0-1.module_el8.10.0+3801+17b19a60 | ALSA-2024:4367 |
| AlmaLinux 8 | idm-ldapjdk +1 | 4.24.0-1.module_el8.10.0+3801+17b19a60 | ALSA-2024:4367 |
| AlmaLinux 8 | idm-pki-ca +8 | 10.15.1-1.module_el8.10.0+3868+cdab0fd8 | ALSA-2024:4367 |
| AlmaLinux 8 | idm-tomcatjss | 7.8.0-1.module_el8.10.0+3801+17b19a60 | ALSA-2024:4367 |
| AlmaLinux 8 | resteasy +1 | 3.0.26-7.module_el8.10.0+3808+9d4ab1fb | ALSA-2024:4367 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 9 | pki-core | 11.5.0-2.el9_4 | RLSA-2024:4165 |
| Rocky Linux 8 | jss | 4.11.0-1.module+el8.10.0+1816+f1a7c8eb | RLSA-2024:4367 |
| Rocky Linux 8 | ldapjdk | 4.24.0-1.module+el8.10.0+1816+f1a7c8eb | RLSA-2024:4367 |
| Rocky Linux 8 | pki-core | 10.15.1-1.module+el8.10.0+1836+57f0c18f | RLSA-2024:4367 |
| Rocky Linux 8 | resteasy | 3.0.26-7.module+el8.10.0+1767+f923f786 | RLSA-2024:4367 |
| Rocky Linux 8 | tomcatjss | 7.8.0-1.module+el8.10.0+1816+f1a7c8eb | RLSA-2024:4367 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | pki-ca +7 | 10.5.18-27.amzn2.0.2 | ALAS2-2024-2586 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 9 | idm-pki-ca +8 | 11.5.0-2.0.1.el9_4 | ELSA-2024-4165 |
| Oracle Linux 8 | idm-jss +1 | 4.11.0-1.module+el8.10.0+90362+5113f0b5 | ELSA-2024-4367 |
| Oracle Linux 8 | idm-ldapjdk +1 | 4.24.0-1.module+el8.10.0+90362+5113f0b5 | ELSA-2024-4367 |
| Oracle Linux 8 | idm-pki-ca +8 | 10.15.1-1.0.1.module+el8.10.0+90362+5113f0b5 | ELSA-2024-4367 |
| Oracle Linux 8 | idm-tomcatjss | 7.8.0-1.module+el8.10.0+90362+5113f0b5 | ELSA-2024-4367 |
| Oracle Linux 8 | resteasy +1 | 3.0.26-7.module+el8.10.0+90362+5113f0b5 | ELSA-2024-4367 |
| Oracle Linux 7 | pki-ca +7 | 10.5.18-32.el7_9 | ELSA-2024-4222 |
Advisories 18
- ALSA-2024:4165 Important: pki-core security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2024:4367 Important: pki-core security update AlmaLinux Security Advisories · Oct 29, 2026
- WID-SEC-2024-1434 Red Hat Enterprise Linux (pki and Libreswan): Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 27, 2026
- RHSA-2024:4413 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- RHSA-2024:4403 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- RHSA-2024:4367 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- RHSA-2024:4222 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- RHSA-2024:4179 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- RHSA-2024:4164 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- RHSA-2024:4165 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- RHSA-2024:4051 Red Hat Security Advisory: pki-core security update Red Hat Security Advisories (RHSA) · Sep 20, 2026
- RHSA-2024:4070 Red Hat Security Advisory: Red Hat Certificate System 10.4 for RHEL 8 security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RLSA-2024:4165 Important: pki-core security update Rocky Linux Security Advisories · Feb 4, 2026
- RLSA-2024:4367 Important: pki-core security update Rocky Linux Security Advisories · May 7, 2025
- ALAS2-2024-2586 Important: pki-core security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jul 11, 2024
- ELSA-2024-4367 Important: pki-core security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Jul 10, 2024
- ELSA-2024-4222 Important: pki-core security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 2, 2024
- ELSA-2024-4165 Important: pki-core security update (Oracle Linux 9) Oracle Linux Security Advisories (ELSA) · Jun 27, 2024
References
- RHSA-2024:4051 vendor-advisory
- RHSA-2024:4070 vendor-advisory
- RHSA-2024:4164 vendor-advisory
- RHSA-2024:4165 vendor-advisory
- RHSA-2024:4179 vendor-advisory
- RHSA-2024:4222 vendor-advisory
- RHSA-2024:4367 vendor-advisory
- RHSA-2024:4403 vendor-advisory
- RHSA-2024:4413 vendor-advisory
- https://access.redhat.com/security/cve/CVE-2023-4727 vdb-entry
- RHBZ#2232218 issue-tracking
- https://github.com/advisories/GHSA-rvm7-rc5g-c98q
- https://github.com/dogtagpki/pki/commit/54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720
- https://github.com/dogtagpki/pki/commit/aa7161ba378caf5cf0471aafb679a842679c8388