Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain     configurations, causes the application of ACL allow and deny rules to be reversed. If a server is     configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules     will deny access and deny rules will grant access. This may result in an escalation of privileges or have     other unintended consequences. (CVE-2018-1080)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pki-core packages installed that are affected by a vulnerability:

  - Dogtag PKI, through version 10.6.1, has a vulnerability     in AAclAuthz.java that, under certain configurations,     causes the application of ACL allow and deny rules to be     reversed. If a server is configured to process allow     rules before deny rules     (authz.evaluateOrder=allow,deny), then allow rules will     deny access and deny rules will grant access. This may     result in an escalation of privileges or have other     unintended consequences. (CVE-2018-1080)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update for pki-core is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

Security Fix(es) :

* pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access (CVE-2018-1080)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Fraser Tweedale (Red Hat).

Bug Fix(es) :

* Previously, when ECC keys were enrolled, Certificate Management over CMS (CMC) authentication failed with a 'TokenException: Unable to insert certificate into temporary database' error. As a consequence, the enrollment failed. This update fixes the problem. As a result, the mentioned bug no longer occurs. (BZ#1550581)

* Previously, Certificate System used the same enrollment profiles for issuing RSA and ECC certificates. As a consequence, the key usage extension in issued certificates did not meet the Common Criteria standard. This update adds ECC-specific enrollment profiles where the key usage extension for TLS server and client certificates are different as described in RFC 6960. Additionally, the update changes existing profiles to issue only RSA certificates. As a result, the key usage extension in ECC certificates now meets the Common Criteria standard. (BZ#1554726)

* The Certificate System server rejects saving invalid access control lists (ACL). As a consequence, when saving an ACL with an empty expression, the server rejected the update and the pkiconsole utility displayed an StringIndexOutOfBoundsException error. With this update, the utility rejects empty ACL expressions. As a result, invalid ACLs cannot be saved and the error is no longer displayed. (BZ#1557883)

* Previously, due to a bug in the Certificate System installation procedure, installing a Key Recovery Authority (KRA) with ECC keys failed. To fix the problem, the installation process has been updated to handle both RSA and ECC subsystems automatically. As a result, installing subsystems with ECC keys no longer fail. (BZ#1581134)

* Previously, during verification, Certificate System encoded the ECC public key incorrectly in CMC Certificate Request Message Format (CRMF) requests. As a consequence, requesting an ECC certificate with Certificate Management over CMS (CMC) in CRMF failed. The problem has been fixed, and as a result, CMC CRMF requests using ECC keys work as expected. (BZ#1585945)

Enhancement(s) :

* The pkispawn man page has been updated and now describes the
--skip-configuration and --skip-installation parameters. (BZ#1551067)

* With this update, Certificate System adds the Subject Alternative Name (SAN) extension by default to server certificates and sets it to the Common Name (CN) of the certificate. (BZ#1581135)

* With this enhancement, users can create Certificate Request Message Format (CRMF) requests without the key archival option when using the CRMFPopClient utility. This feature increases flexibility because a Key Recovery Authority (KRA) certificate is no longer required.
Previously, if the user did not pass the '-b transport_certificate_file' option to CRMFPopClient, the utility automatically used the KRA transport certificate stored in the transport.txt file. With this update, if '-b transport_certificate_file' is not specified, Certificate System creates a request without using key archival. (BZ#1588945)

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2018-1979 advisory.

    - Bugzilla Bug #1589307 - CVE-2018-1080 pki-core: Mishandled       ACL configuration in AAclAuthz.java reverses rules that allow       and deny access [rhel-7.5.z] (ftweedal, cfu)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - pki-core: Mishandled ACL configuration in AAclAuthz.java     reverses rules that allow and deny access     (CVE-2018-1080)

Bug Fix(es) :

  - Previously, when ECC keys were enrolled, Certificate     Management over CMS (CMC) authentication failed with a     'TokenException: Unable to insert certificate into     temporary database' error. As a consequence, the     enrollment failed. This update fixes the problem. As a     result, the mentioned bug no longer occurs.

  - Previously, Certificate System used the same enrollment     profiles for issuing RSA and ECC certificates. As a     consequence, the key usage extension in issued     certificates did not meet the Common Criteria standard.
    This update adds ECC-specific enrollment profiles where     the key usage extension for TLS server and client     certificates are different as described in RFC 6960.
    Additionally, the update changes existing profiles to     issue only RSA certificates. As a result, the key usage     extension in ECC certificates now meets the Common     Criteria standard.

  - The Certificate System server rejects saving invalid     access control lists (ACL). As a consequence, when     saving an ACL with an empty expression, the server     rejected the update and the pkiconsole utility displayed     an StringIndexOutOfBoundsException error. With this     update, the utility rejects empty ACL expressions. As a     result, invalid ACLs cannot be saved and the error is no     longer displayed.

  - Previously, due to a bug in the Certificate System     installation procedure, installing a Key Recovery     Authority (KRA) with ECC keys failed. To fix the     problem, the installation process has been updated to     handle both RSA and ECC subsystems automatically. As a     result, installing subsystems with ECC keys no longer     fail.

  - Previously, during verification, Certificate System     encoded the ECC public key incorrectly in CMC     Certificate Request Message Format (CRMF) requests. As a     consequence, requesting an ECC certificate with     Certificate Management over CMS (CMC) in CRMF failed.
    The problem has been fixed, and as a result, CMC CRMF     requests using ECC keys work as expected.

Enhancement(s) :

  - The pkispawn man page has been updated and now describes     the - --skip- configuration and --skip-installation     parameters.

  - With this update, Certificate System adds the Subject     Alternative Name (SAN) extension by default to server     certificates and sets it to the Common Name (CN) of the     certificate.

  - With this enhancement, users can create Certificate     Request Message Format (CRMF) requests without the key     archival option when using the CRMFPopClient utility.
    This feature increases flexibility because a Key     Recovery Authority (KRA) certificate is no longer     required. Previously, if the user did not pass the '-b     transport_certificate_file' option to CRMFPopClient, the     utility automatically used the KRA transport certificate     stored in the transport.txt file. With this update, if     '-b transport_certificate_file' is not specified,     Certificate System creates a request without using key     archival.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1979 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access     (CVE-2018-1080)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    This issue was discovered by Fraser Tweedale (Red Hat).

    Bug Fix(es):

    * Previously, when ECC keys were enrolled, Certificate Management over CMS (CMC) authentication failed     with a TokenException: Unable to insert certificate into temporary database error. As a consequence, the     enrollment failed. This update fixes the problem. As a result, the mentioned bug no longer occurs.
    (BZ#1550581)

    * Previously, Certificate System used the same enrollment profiles for issuing RSA and ECC certificates.
    As a consequence, the key usage extension in issued certificates did not meet the Common Criteria     standard. This update adds ECC-specific enrollment profiles where the key usage extension for TLS server     and client certificates are different as described in RFC 6960. Additionally, the update changes existing     profiles to issue only RSA certificates. As a result, the key usage extension in ECC certificates now     meets the Common Criteria standard. (BZ#1554726)

    * The Certificate System server rejects saving invalid access control lists (ACL). As a consequence, when     saving an ACL with an empty expression, the server rejected the update and the pkiconsole utility     displayed an StringIndexOutOfBoundsException error. With this update, the utility rejects empty ACL     expressions. As a result, invalid ACLs cannot be saved and the error is no longer displayed. (BZ#1557883)

    * Previously, due to a bug in the Certificate System installation procedure, installing a Key Recovery     Authority (KRA) with ECC keys failed. To fix the problem, the installation process has been updated to     handle both RSA and ECC subsystems automatically. As a result, installing subsystems with ECC keys no     longer fail. (BZ#1581134)

    * Previously, during verification, Certificate System encoded the ECC public key incorrectly in CMC     Certificate Request Message Format (CRMF) requests. As a consequence, requesting an ECC certificate with     Certificate Management over CMS (CMC) in CRMF failed. The problem has been fixed, and as a result, CMC     CRMF requests using ECC keys work as expected. (BZ#1585945)

    Enhancement(s):

    * The pkispawn man page has been updated and now describes the --skip-configuration and --skip-     installation parameters. (BZ#1551067)

    * With this update, Certificate System adds the Subject Alternative Name (SAN) extension by default to     server certificates and sets it to the Common Name (CN) of the certificate. (BZ#1581135)

    * With this enhancement, users can create Certificate Request Message Format (CRMF) requests without the     key archival option when using the CRMFPopClient utility. This feature increases flexibility because a Key     Recovery Authority (KRA) certificate is no longer required. Previously, if the user did not pass the -b     transport_certificate_file option to CRMFPopClient, the utility automatically used the KRA transport     certificate stored in the transport.txt file. With this update, if -b transport_certificate_file is not     specified, Certificate System creates a request without using key archival. (BZ#1588945)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
221719	Linux Distros Unpatched Vulnerability : CVE-2018-1080	Nessus	Misc.	high
127259	NewStart CGSL CORE 5.04 / MAIN 5.04 : pki-core Vulnerability (NS-SA-2019-0063)	Nessus	NewStart CGSL Local Security Checks	high
110906	CentOS 7 : pki-core (CESA-2018:1979)	Nessus	CentOS Local Security Checks	high
110750	Oracle Linux 7 : pki-core (ELSA-2018-1979)	Nessus	Oracle Linux Local Security Checks	high
110719	Scientific Linux Security Update : pki-core on SL7.x x86_64 (20180626)	Nessus	Scientific Linux Local Security Checks	high
110710	RHEL 7 : pki-core (RHSA-2018:1979)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-1080

high

Tenable Plugins

high

high

high

high

high

high