CVE-2012-4555

CVE-2012-4555 affects Red Hat Certificate System (RHCS) pki-tps before version 8.1.3. The vulnerability arises from improper handling of interruptions during token format operations, allowing a remote attacker to cause a denial of service via a NULL pointer dereference, crashing the Apache httpd ...

CVE-2012-4543

CVE-2012-4543 describes multiple XSS vulnerabilities in Red Hat Certificate System (RHCS) before 8.1.3. The flaws allow remote attackers to inject arbitrary web script or HTML via the (1) pageStart or (2) pageSize parameters to the displayCRL script, or (3) nonce variable to the profileProcess sc...

CVE-2012-2662

CVE-2012-2662 affects Red Hat Certificate System (RHCS) and Dogtag Certificate System. The vulnerability enables multiple cross-site scripting (XSS) in the web interface via unspecified parameters on the System Agent and End Entity pages, allowing remote attackers to inject arbitrary scripts/HTML...

CVE-2012-3367: Undefined Security Weakness

Red Hat Certificate System RHCS before 8.1.1 and Dogtag Certificate System does not properly check certificate revocation requests made through the web interface, which allows remote attackers with permissions to revoke end entity certificates to revoke the Certificate Authority CA certificate...

Authentication flaw

Red Hat Certificate System RHCS 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authorit...

CVE-2010-3868

CVE-2010-3868 affects Red Hat Certificate System (RHCS) 7.3/8 and Dogtag Certificate System: unauthenticated decryption of SCEP one-time PINs in SCEP requests allows remote attackers who sniff the network to obtain PINs. Red Hat/RHSA advisories (0837/0838) fix this by restricting decryption to au...

CVE-2009-0588: Undefined Security Weakness

agent/request/op.cgi in the Registration Authority RA component in Red Hat Certificate System RHCS 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate requests queued for arbitrary agent groups via a modified request ID field...

Authentication flaw

The verifyProof function in the Token Processing System TPS component in Red Hat Certificate System RHCS 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileg...

CVE-2008-5082

The CVE-2008-5082 issue affects Red Hat Certificate System (RHCS) 7.1–7.3 and Dogtag Certificate System 1.0, where the TPS verifyProof function could succeed enrollment with a software key even when a hardware key was expected. This allows remote authenticated users with enrollment privileges to ...

CVE-2008-1676

Red Hat PKI Common Framework rhpki-common in Red Hat Certificate System aka Certificate Server or RHCS 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended...

CVE-2008-1676

The CVE-2008-1676 issue concerns Red Hat Certificate System’s PKI Common Framework (rhpki-common) used by RHCS and Netscape Certificate Management System. The root cause is that certificate signing request (CSR) processing did not honor Certificate Authority profile constraints on Extensions, ena...

CVE-2007-4994

CVE-2007-4994 affects Red Hat Certificate System (RHCS) where new revocations generated during CRL creation could cause revoked certificates to be omitted from the CRL, enabling a bypass of revocation for some certificates. Supported by Red Hat advisories (RHSA-2007:0934; RHSA-2008:0566) and rela...