Server side request forgery (ssrf)

agent/request/op.cgi in the Registration Authority RA component in Red Hat Certificate System RHCS 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate requests queued for arbitrary agent groups via a modified request ID field...

CVE-2009-0588

agent/request/op.cgi in the Registration Authority RA component in Red Hat Certificate System RHCS 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate requests queued for arbitrary agent groups via a modified request ID field...

CVE-2009-0588

The CVE-2009-0588 issue affects Red Hat Certificate System 7.3 (RA/Registration Authority) and Dogtag Certificate System, where agent/request/op.cgi processing allowed remote authenticated users to approve certificate requests in arbitrary agent-group queues by manipulating the request ID. Root c...

rhpki-ra: improper authorization checks in Cerificate System's Registration Authority

agent/request/op.cgi in the Registration Authority RA component in Red Hat Certificate System RHCS 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate requests queued for arbitrary agent groups via a modified request ID field...

Authentication flaw

The verifyProof function in the Token Processing System TPS component in Red Hat Certificate System RHCS 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileg...

CVE-2008-5082

The verifyProof function in the Token Processing System TPS component in Red Hat Certificate System RHCS 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileg...

CVE-2008-5082

The verifyProof function in the Token Processing System TPS component in Red Hat Certificate System RHCS 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileg...

CVE-2008-5082

The CVE-2008-5082 issue affects Red Hat Certificate System (RHCS) 7.1–7.3 and Dogtag Certificate System 1.0, where the TPS verifyProof function could succeed enrollment with a software key even when a hardware key was expected. This allows remote authenticated users with enrollment privileges to ...

System: missing public key challenge proof verification in the TPS component

The verifyProof function in the Token Processing System TPS component in Red Hat Certificate System RHCS 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileg...

CVE-2008-2367

Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files...

Design/Logic Flaw

Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files...

CVE-2008-2368

Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files...

CVE-2008-2368

Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files...

CVE-2008-2367

CVE-2008-2367 affects Red Hat Certificate System 7.2. The root cause is insecure default file permissions on configuration files (e.g., password.conf) allowing local attackers to read sensitive credentials. Connected advisories note remediation via updated packages for Red Hat Certificate System ...

CVE-2008-2367

Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files...

CVE-2008-2368

Red Hat Certificate System 7.2 stores passwords in cleartext in debug/log files (e.g., UserDirEnrollment log and RA wizard installer log) and uses weak file permissions, enabling local read access. The issue is fixed in Red Hat advisories RHSA-2009:0006/0007 by updating pkisetup, rhpki-* and rela...

System: insecure config file permissions

Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files...

rhcs CRL can get corrupted

Certificate Server 7.2 in Red Hat Certificate System RHCS does not properly handle new revocations that occur while a Certificate Revocation List CRL is being generated, which might prevent certain revoked certificates from appearing on the CRL quickly and allow users with revoked certificates to...

Moderate: Red Hat Security Advisory: rhpki-util, rhpki-common, and rhpki-ca security and bug fix update

Updated rhpki-util, rhpki-common, and rhpki-ca packages that fix a security issue and several bugs are now available for Red Hat Certificate System 7.3. This update has been rated as having moderate security impact by the Red Hat Security Response Team. Red Hat Certificate System RHCS is an...

CVE-2008-1676

Red Hat PKI Common Framework rhpki-common in Red Hat Certificate System aka Certificate Server or RHCS 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended...