Lucene search
RedhatCVELIST:CVE-2020-25688HistoryNov 23, 2020 - 9:07 p.m.
CVE-2020-25688
2020-11-2321:07:06
CWE-321
redhat
www.cve.org
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a cluster, they could use the private key to decode API requests that should be protected by TLS sessions, potentially obtaining information they would not otherwise be able to. These certificates are not used for service authentication, so no opportunity for impersonation or active MITM attacks were made possible.
CNA Affected
[
{
"product": "rhacm",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "All rhacm versions before 2.0.5 and before 2.1.0"
}
]
}
]Related
nvd
nvd
CVE-2020-25688
2020-11-23 22:15:12
cve
cve
CVE-2020-25688
2020-11-23 22:15:12
redhatcve
redhatcve
CVE-2020-25688
2020-11-05 09:59:31
prion
prion
Authentication flaw
2020-11-23 22:15:00