Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

redhat логотип

CVE-2017-7537

Опубликовано: 21 июл. 2017
Источник: redhat
CVSS3: 5.9
EPSS Низкий

Описание

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.

Затронутые пакеты

ПлатформаПакетСостояниеРекомендацияРелиз
Red Hat Certificate System 9pki-coreNot affected
Red Hat Enterprise Linux 6pki-coreNot affected
Red Hat Enterprise Linux 7pki-coreFixedRHSA-2017:233501.08.2017

Показывать по

Дополнительная информация

Статус:

Moderate
Дефект:
CWE-287
https://bugzilla.redhat.com/show_bug.cgi?id=1470817pki-core: mock CMC authentication plugin with hardcoded secret enabled by default

EPSS

Процентиль: 24%
0.00079
Низкий

5.9 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.9
ubuntu
больше 7 лет назад

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.

CVSS3: 5.9
nvd
больше 7 лет назад

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.

CVSS3: 5.9
debian
больше 7 лет назад

It was found that a mock CMC authentication plugin with a hardcoded se ...

CVSS3: 7.5
github
больше 3 лет назад

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.

oracle-oval
больше 8 лет назад

ELSA-2017-2335: pki-core security update (MODERATE)

EPSS

Процентиль: 24%
0.00079
Низкий

5.9 Medium

CVSS3