An update for pki-core is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

Security Fix(es) :

* pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access (CVE-2018-1080)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Fraser Tweedale (Red Hat).

Bug Fix(es) :

* Previously, when ECC keys were enrolled, Certificate Management over CMS (CMC) authentication failed with a 'TokenException: Unable to insert certificate into temporary database' error. As a consequence, the enrollment failed. This update fixes the problem. As a result, the mentioned bug no longer occurs. (BZ#1550581)

* Previously, Certificate System used the same enrollment profiles for issuing RSA and ECC certificates. As a consequence, the key usage extension in issued certificates did not meet the Common Criteria standard. This update adds ECC-specific enrollment profiles where the key usage extension for TLS server and client certificates are different as described in RFC 6960. Additionally, the update changes existing profiles to issue only RSA certificates. As a result, the key usage extension in ECC certificates now meets the Common Criteria standard. (BZ#1554726)

* The Certificate System server rejects saving invalid access control lists (ACL). As a consequence, when saving an ACL with an empty expression, the server rejected the update and the pkiconsole utility displayed an StringIndexOutOfBoundsException error. With this update, the utility rejects empty ACL expressions. As a result, invalid ACLs cannot be saved and the error is no longer displayed. (BZ#1557883)

* Previously, due to a bug in the Certificate System installation procedure, installing a Key Recovery Authority (KRA) with ECC keys failed. To fix the problem, the installation process has been updated to handle both RSA and ECC subsystems automatically. As a result, installing subsystems with ECC keys no longer fail. (BZ#1581134)

* Previously, during verification, Certificate System encoded the ECC public key incorrectly in CMC Certificate Request Message Format (CRMF) requests. As a consequence, requesting an ECC certificate with Certificate Management over CMS (CMC) in CRMF failed. The problem has been fixed, and as a result, CMC CRMF requests using ECC keys work as expected. (BZ#1585945)

Enhancement(s) :

* The pkispawn man page has been updated and now describes the
--skip-configuration and --skip-installation parameters. (BZ#1551067)

* With this update, Certificate System adds the Subject Alternative Name (SAN) extension by default to server certificates and sets it to the Common Name (CN) of the certificate. (BZ#1581135)

* With this enhancement, users can create Certificate Request Message Format (CRMF) requests without the key archival option when using the CRMFPopClient utility. This feature increases flexibility because a Key Recovery Authority (KRA) certificate is no longer required.
Previously, if the user did not pass the '-b transport_certificate_file' option to CRMFPopClient, the utility automatically used the KRA transport certificate stored in the transport.txt file. With this update, if '-b transport_certificate_file' is not specified, Certificate System creates a request without using key archival. (BZ#1588945)

Security Fix(es) :

  - pki-core: Mishandled ACL configuration in AAclAuthz.java     reverses rules that allow and deny access     (CVE-2018-1080)

Bug Fix(es) :

  - Previously, when ECC keys were enrolled, Certificate     Management over CMS (CMC) authentication failed with a     'TokenException: Unable to insert certificate into     temporary database' error. As a consequence, the     enrollment failed. This update fixes the problem. As a     result, the mentioned bug no longer occurs.

  - Previously, Certificate System used the same enrollment     profiles for issuing RSA and ECC certificates. As a     consequence, the key usage extension in issued     certificates did not meet the Common Criteria standard.
    This update adds ECC-specific enrollment profiles where     the key usage extension for TLS server and client     certificates are different as described in RFC 6960.
    Additionally, the update changes existing profiles to     issue only RSA certificates. As a result, the key usage     extension in ECC certificates now meets the Common     Criteria standard.

  - The Certificate System server rejects saving invalid     access control lists (ACL). As a consequence, when     saving an ACL with an empty expression, the server     rejected the update and the pkiconsole utility displayed     an StringIndexOutOfBoundsException error. With this     update, the utility rejects empty ACL expressions. As a     result, invalid ACLs cannot be saved and the error is no     longer displayed.

  - Previously, due to a bug in the Certificate System     installation procedure, installing a Key Recovery     Authority (KRA) with ECC keys failed. To fix the     problem, the installation process has been updated to     handle both RSA and ECC subsystems automatically. As a     result, installing subsystems with ECC keys no longer     fail.

  - Previously, during verification, Certificate System     encoded the ECC public key incorrectly in CMC     Certificate Request Message Format (CRMF) requests. As a     consequence, requesting an ECC certificate with     Certificate Management over CMS (CMC) in CRMF failed.
    The problem has been fixed, and as a result, CMC CRMF     requests using ECC keys work as expected.

Enhancement(s) :

  - The pkispawn man page has been updated and now describes     the - --skip- configuration and --skip-installation     parameters.

  - With this update, Certificate System adds the Subject     Alternative Name (SAN) extension by default to server     certificates and sets it to the Common Name (CN) of the     certificate.

  - With this enhancement, users can create Certificate     Request Message Format (CRMF) requests without the key     archival option when using the CRMFPopClient utility.
    This feature increases flexibility because a Key     Recovery Authority (KRA) certificate is no longer     required. Previously, if the user did not pass the '-b     transport_certificate_file' option to CRMFPopClient, the     utility automatically used the KRA transport certificate     stored in the transport.txt file. With this update, if     '-b transport_certificate_file' is not specified,     Certificate System creates a request without using key     archival.

From Red Hat Security Advisory 2018:1979 :

An update for pki-core is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

Security Fix(es) :

* pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access (CVE-2018-1080)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

This issue was discovered by Fraser Tweedale (Red Hat).

Bug Fix(es) :

* Previously, when ECC keys were enrolled, Certificate Management over CMS (CMC) authentication failed with a 'TokenException: Unable to insert certificate into temporary database' error. As a consequence, the enrollment failed. This update fixes the problem. As a result, the mentioned bug no longer occurs. (BZ#1550581)

* Previously, Certificate System used the same enrollment profiles for issuing RSA and ECC certificates. As a consequence, the key usage extension in issued certificates did not meet the Common Criteria standard. This update adds ECC-specific enrollment profiles where the key usage extension for TLS server and client certificates are different as described in RFC 6960. Additionally, the update changes existing profiles to issue only RSA certificates. As a result, the key usage extension in ECC certificates now meets the Common Criteria standard. (BZ#1554726)

* The Certificate System server rejects saving invalid access control lists (ACL). As a consequence, when saving an ACL with an empty expression, the server rejected the update and the pkiconsole utility displayed an StringIndexOutOfBoundsException error. With this update, the utility rejects empty ACL expressions. As a result, invalid ACLs cannot be saved and the error is no longer displayed. (BZ#1557883)

* Previously, due to a bug in the Certificate System installation procedure, installing a Key Recovery Authority (KRA) with ECC keys failed. To fix the problem, the installation process has been updated to handle both RSA and ECC subsystems automatically. As a result, installing subsystems with ECC keys no longer fail. (BZ#1581134)

* Previously, during verification, Certificate System encoded the ECC public key incorrectly in CMC Certificate Request Message Format (CRMF) requests. As a consequence, requesting an ECC certificate with Certificate Management over CMS (CMC) in CRMF failed. The problem has been fixed, and as a result, CMC CRMF requests using ECC keys work as expected. (BZ#1585945)

Enhancement(s) :

* The pkispawn man page has been updated and now describes the
--skip-configuration and --skip-installation parameters. (BZ#1551067)

* With this update, Certificate System adds the Subject Alternative Name (SAN) extension by default to server certificates and sets it to the Common Name (CN) of the certificate. (BZ#1581135)

* With this enhancement, users can create Certificate Request Message Format (CRMF) requests without the key archival option when using the CRMFPopClient utility. This feature increases flexibility because a Key Recovery Authority (KRA) certificate is no longer required.
Previously, if the user did not pass the '-b transport_certificate_file' option to CRMFPopClient, the utility automatically used the KRA transport certificate stored in the transport.txt file. With this update, if '-b transport_certificate_file' is not specified, Certificate System creates a request without using key archival. (BZ#1588945)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2018:1979 advisory.

  - pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access     (CVE-2018-1080)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pki-core packages installed that are affected by a vulnerability:

  - Dogtag PKI, through version 10.6.1, has a vulnerability     in AAclAuthz.java that, under certain configurations,     causes the application of ACL allow and deny rules to be     reversed. If a server is configured to process allow     rules before deny rules     (authz.evaluateOrder=allow,deny), then allow rules will     deny access and deny rules will grant access. This may     result in an escalation of privileges or have other     unintended consequences. (CVE-2018-1080)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access     (CVE-2018-1080)

  - pki-core: Unprivileged users can renew any certificate (CVE-2021-20179)

  - A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca     module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An     attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which     can execute arbitrary code when viewed in a browser. (CVE-2019-10221)

  - A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based     cross-site scripting (XSS) attack to inject code into the search query form which can get automatically     executed. The highest threat from this vulnerability is to data integrity. (CVE-2020-25715)

  - A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when     directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent     network to impersonate another user within the scope of the domain, but they would not be able to decrypt     message content. (CVE-2022-2393)

  - Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This     flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially     crafted HTTP requests. (CVE-2022-2414)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

ID	Name	Product	Family	Published	Updated	Severity
110906	CentOS 7 : pki-core (CESA-2018:1979)	Nessus	CentOS Local Security Checks	7/5/2018	12/31/2019	high
110719	Scientific Linux Security Update : pki-core on SL7.x x86_64 (20180626)	Nessus	Scientific Linux Local Security Checks	6/27/2018	2/24/2020	high
110750	Oracle Linux 7 : pki-core (ELSA-2018-1979)	Nessus	Oracle Linux Local Security Checks	6/28/2018	9/27/2019	high
110710	RHEL 7 : pki-core (RHSA-2018:1979)	Nessus	Red Hat Local Security Checks	6/27/2018	4/24/2024	high
127259	NewStart CGSL CORE 5.04 / MAIN 5.04 : pki-core Vulnerability (NS-SA-2019-0063)	Nessus	NewStart CGSL Local Security Checks	8/12/2019	1/14/2021	high
196293	RHEL 6 : pki-core (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	5/11/2024	5/11/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high