Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2010-3869
Vulnerability from cvelistv5
Published
2010-11-17 15:00
Modified
2024-08-07 03:26
Severity ?
EPSS score ?
Summary
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.
References
{ containers: { adp: [ { providerMetadata: { dateUpdated: "2024-08-07T03:26:12.228Z", orgId: "af854a3a-2127-422b-91ae-364da2661108", shortName: "CVE", }, references: [ { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { name: "RHSA-2010:0837", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://rhn.redhat.com/errata/RHSA-2010-0837.html", }, { tags: [ "x_refsource_CONFIRM", "x_transferred", ], url: "https://fedorahosted.org/pki/changeset/1246", }, { name: "RHSA-2010:0838", tags: [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred", ], url: "https://rhn.redhat.com/errata/RHSA-2010-0838.html", }, { name: "1024697", tags: [ "vdb-entry", "x_refsource_SECTRACK", "x_transferred", ], url: "http://securitytracker.com/id?1024697", }, { name: "69148", tags: [ "vdb-entry", "x_refsource_OSVDB", "x_transferred", ], url: "http://www.osvdb.org/69148", }, { name: "42181", tags: [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred", ], url: "http://secunia.com/advisories/42181", }, ], title: "CVE Program Container", }, ], cna: { affected: [ { product: "n/a", vendor: "n/a", versions: [ { status: "affected", version: "n/a", }, ], }, ], descriptions: [ { lang: "en", value: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", }, ], problemTypes: [ { descriptions: [ { description: "n/a", lang: "en", type: "text", }, ], }, ], providerMetadata: { dateUpdated: "2010-11-17T15:00:00Z", orgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", shortName: "redhat", }, references: [ { tags: [ "x_refsource_CONFIRM", ], url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { name: "RHSA-2010:0837", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://rhn.redhat.com/errata/RHSA-2010-0837.html", }, { tags: [ "x_refsource_CONFIRM", ], url: "https://fedorahosted.org/pki/changeset/1246", }, { name: "RHSA-2010:0838", tags: [ "vendor-advisory", "x_refsource_REDHAT", ], url: "https://rhn.redhat.com/errata/RHSA-2010-0838.html", }, { name: "1024697", tags: [ "vdb-entry", "x_refsource_SECTRACK", ], url: "http://securitytracker.com/id?1024697", }, { name: "69148", tags: [ "vdb-entry", "x_refsource_OSVDB", ], url: "http://www.osvdb.org/69148", }, { name: "42181", tags: [ "third-party-advisory", "x_refsource_SECUNIA", ], url: "http://secunia.com/advisories/42181", }, ], }, }, cveMetadata: { assignerOrgId: "53f830b8-0a3f-465b-8143-3b8a9948e749", assignerShortName: "redhat", cveId: "CVE-2010-3869", datePublished: "2010-11-17T15:00:00Z", dateReserved: "2010-10-08T00:00:00Z", dateUpdated: "2024-08-07T03:26:12.228Z", state: "PUBLISHED", }, dataType: "CVE_RECORD", dataVersion: "5.1", "vulnerability-lookup:meta": { nvd: "{\"cve\":{\"id\":\"CVE-2010-3869\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2010-11-17T16:00:01.920\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.\"},{\"lang\":\"es\",\"value\":\"Red Hat Certificate System (RHCS) v7.3 y v8 y Dogtag Certificate System permiten a usuarios autenticados remotamente generar un número aleatorio de certificados mediante la sustitución de un único PIN SCEP one-time.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:S/C:N/I:P/A:N\",\"baseScore\":4.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"SINGLE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-310\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:certificate_system:7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2654E6A-190C-4D5C-ABC0-89011DD8E293\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:certificate_system:8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C2EF75FF-FCDB-433C-A7B9-4DBAABAC6643\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:redhat:dogtag_certificate_system:*:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06D606EF-447B-42C5-ADBE-14515257262B\"}]}]}],\"references\":[{\"url\":\"http://secunia.com/advisories/42181\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://securitytracker.com/id?1024697\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.osvdb.org/69148\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=648883\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://fedorahosted.org/pki/changeset/1246\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Patch\"]},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2010-0837.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2010-0838.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/42181\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://securitytracker.com/id?1024697\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.osvdb.org/69148\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=648883\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://fedorahosted.org/pki/changeset/1246\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\"]},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2010-0837.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://rhn.redhat.com/errata/RHSA-2010-0838.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}", }, }
rhsa-2010:0837
Vulnerability from csaf_redhat
Published
2010-11-08 20:06
Modified
2024-11-22 03:45
Summary
Red Hat Security Advisory: rhpki security and enhancement update
Notes
Topic
Updated rhpki-ca, rhpki-common, and rhpki-util packages that fix three
security issues and add several enhancements are now available for Red Hat
Certificate System 7.3.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Certificate System is an enterprise software system designed to
manage enterprise public key infrastructure (PKI) deployments. Simple
Certificate Enrollment Protocol (SCEP) is a PKI communication protocol
used to automatically enroll certificates for network devices.
The certificate authority allowed unauthenticated users to request the
one-time PIN in an SCEP request to be decrypted. An attacker able to sniff
an SCEP request from a network device could request the certificate
authority to decrypt the request, allowing them to obtain the one-time
PIN. With this update, the certificate authority only handles decryption
requests from authenticated registration authorities. (CVE-2010-3868)
The certificate authority allowed the one-time PIN used in SCEP requests
to be re-used. An attacker possessing a valid SCEP enrollment one-time PIN
could use it to generate an unlimited number of certificates.
(CVE-2010-3869)
The certificate authority used the MD5 hash algorithm to sign all SCEP
protocol responses. As MD5 is not collision resistant, an attacker could
use this flaw to perform an MD5 chosen-prefix collision attack to generate
attack-chosen output signed using the certificate authority's key.
(CVE-2004-2761)
This update also adds the following enhancements:
* Support for the stronger encryption algorithm Triple-DES (DES3), and
stronger hash algorithms SHA1, SHA256, and SHA512, for use in SCEP
communication. These algorithms are in addition to the previously supported
DES and MD5 algorithms.
* New configuration options for the SCEP server can define the default and
allowed encryption and hash algorithms. These options allow disabling uses
of the weaker algorithms not required by network devices and prevent
possible downgrade attacks. These can be configured by adding the following
options to the certificate authority's CS.cfg configuration file:
ca.scep.encryptionAlgorithm=DES3
ca.scep.allowedEncryptionAlgorithms=DES3
ca.scep.hashAlgorithm=SHA1
ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512
* With this update, the certificate authority's SCEP server is disabled by
default. The SCEP server can be enabled by adding the 'ca.scep.enable=true'
option to the certificate authority's CS.cfg configuration file.
* A separate key pair can now be configured for use in SCEP communication.
Previously, the main certificate authority's key pair was used for SCEP
communication too. A designated SCEP key pair can be referenced by adding
a new option, ca.scep.nickname=[scep certificate nickname], to the
certificate authority's CS.cfg configuration file.
* The certificate authority now allows the size of nonces used in SCEP
requests to be restricted by adding a new option, ca.scep.nonceSizeLimit=
[number of bytes], to the certificate authority's CS.cfg configuration
file. The limit is set to 16 bytes in the default CS.cfg configuration
file.
All users of Red Hat Certificate System 7.3 should upgrade to these updated
packages, which resolve these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated rhpki-ca, rhpki-common, and rhpki-util packages that fix three\nsecurity issues and add several enhancements are now available for Red Hat\nCertificate System 7.3.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", title: "Topic", }, { category: "general", text: "Red Hat Certificate System is an enterprise software system designed to\nmanage enterprise public key infrastructure (PKI) deployments. Simple\nCertificate Enrollment Protocol (SCEP) is a PKI communication protocol\nused to automatically enroll certificates for network devices.\n\nThe certificate authority allowed unauthenticated users to request the\none-time PIN in an SCEP request to be decrypted. An attacker able to sniff\nan SCEP request from a network device could request the certificate\nauthority to decrypt the request, allowing them to obtain the one-time\nPIN. With this update, the certificate authority only handles decryption\nrequests from authenticated registration authorities. (CVE-2010-3868)\n\nThe certificate authority allowed the one-time PIN used in SCEP requests\nto be re-used. An attacker possessing a valid SCEP enrollment one-time PIN\ncould use it to generate an unlimited number of certificates.\n(CVE-2010-3869)\n\nThe certificate authority used the MD5 hash algorithm to sign all SCEP\nprotocol responses. As MD5 is not collision resistant, an attacker could\nuse this flaw to perform an MD5 chosen-prefix collision attack to generate\nattack-chosen output signed using the certificate authority's key.\n(CVE-2004-2761)\n\nThis update also adds the following enhancements:\n\n* Support for the stronger encryption algorithm Triple-DES (DES3), and\nstronger hash algorithms SHA1, SHA256, and SHA512, for use in SCEP\ncommunication. These algorithms are in addition to the previously supported\nDES and MD5 algorithms.\n\n* New configuration options for the SCEP server can define the default and\nallowed encryption and hash algorithms. These options allow disabling uses\nof the weaker algorithms not required by network devices and prevent\npossible downgrade attacks. These can be configured by adding the following\noptions to the certificate authority's CS.cfg configuration file:\n\n ca.scep.encryptionAlgorithm=DES3\n ca.scep.allowedEncryptionAlgorithms=DES3\n ca.scep.hashAlgorithm=SHA1\n ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512\n\n* With this update, the certificate authority's SCEP server is disabled by\ndefault. The SCEP server can be enabled by adding the 'ca.scep.enable=true'\noption to the certificate authority's CS.cfg configuration file.\n\n* A separate key pair can now be configured for use in SCEP communication.\nPreviously, the main certificate authority's key pair was used for SCEP\ncommunication too. A designated SCEP key pair can be referenced by adding\na new option, ca.scep.nickname=[scep certificate nickname], to the\ncertificate authority's CS.cfg configuration file.\n\n* The certificate authority now allows the size of nonces used in SCEP\nrequests to be restricted by adding a new option, ca.scep.nonceSizeLimit=\n[number of bytes], to the certificate authority's CS.cfg configuration\nfile. The limit is set to 16 bytes in the default CS.cfg configuration\nfile.\n\nAll users of Red Hat Certificate System 7.3 should upgrade to these updated\npackages, which resolve these issues and add these enhancements.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2010:0837", url: "https://access.redhat.com/errata/RHSA-2010:0837", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0837.json", }, ], title: "Red Hat Security Advisory: rhpki security and enhancement update", tracking: { current_release_date: "2024-11-22T03:45:37+00:00", generator: { date: "2024-11-22T03:45:37+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2010:0837", initial_release_date: "2010-11-08T20:06:00+00:00", revision_history: [ { date: "2010-11-08T20:06:00+00:00", number: "1", summary: "Initial version", }, { date: "2010-11-08T15:06:51+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T03:45:37+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Certificate System 7.3 for 4AS", product: { name: "Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, { category: "product_name", name: "Red Hat Certificate System 7.3 for 4ES", product: { name: "Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, ], category: "product_family", name: "Red Hat Certificate System", }, { branches: [ { category: "product_version", name: "rhpki-ca-0:7.3.0-21.el4.noarch", product: { name: "rhpki-ca-0:7.3.0-21.el4.noarch", product_id: "rhpki-ca-0:7.3.0-21.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-ca@7.3.0-21.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-common-0:7.3.0-41.el4.noarch", product: { name: "rhpki-common-0:7.3.0-41.el4.noarch", product_id: "rhpki-common-0:7.3.0-41.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-common@7.3.0-41.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-util-0:7.3.0-21.el4.noarch", product: { name: "rhpki-util-0:7.3.0-21.el4.noarch", product_id: "rhpki-util-0:7.3.0-21.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-util@7.3.0-21.el4?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-common-0:7.3.0-41.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", }, product_reference: "rhpki-common-0:7.3.0-41.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-util-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-util-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-common-0:7.3.0-41.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", }, product_reference: "rhpki-common-0:7.3.0-41.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-util-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-util-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, ], }, vulnerabilities: [ { cve: "CVE-2004-2761", discovery_date: "2008-12-30T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648886", }, ], notes: [ { category: "description", text: "The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.", title: "Vulnerability description", }, { category: "summary", text: "MD5: MD5 Message-Digest Algorithm is not collision resistant", title: "Vulnerability summary", }, { category: "other", text: "Please see https://access.redhat.com/solutions/15378", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-2761", }, { category: "external", summary: "RHBZ#648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-2761", url: "https://www.cve.org/CVERecord?id=CVE-2004-2761", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", }, ], release_date: "2008-12-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:06:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0837", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "MD5: MD5 Message-Digest Algorithm is not collision resistant", }, { cve: "CVE-2010-3868", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648882", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.", title: "Vulnerability description", }, { category: "summary", text: "System: unauthenticated user can request SCEP one-time PIN decryption", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3868", }, { category: "external", summary: "RHBZ#648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3868", url: "https://www.cve.org/CVERecord?id=CVE-2010-3868", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:06:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0837", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:H/Au:N/C:P/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: unauthenticated user can request SCEP one-time PIN decryption", }, { cve: "CVE-2010-3869", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648883", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", title: "Vulnerability description", }, { category: "summary", text: "System: SCEP one-time PIN reuse", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3869", }, { category: "external", summary: "RHBZ#648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3869", url: "https://www.cve.org/CVERecord?id=CVE-2010-3869", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:06:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0837", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: SCEP one-time PIN reuse", }, ], }
rhsa-2010_0837
Vulnerability from csaf_redhat
Published
2010-11-08 20:06
Modified
2024-11-22 03:45
Summary
Red Hat Security Advisory: rhpki security and enhancement update
Notes
Topic
Updated rhpki-ca, rhpki-common, and rhpki-util packages that fix three
security issues and add several enhancements are now available for Red Hat
Certificate System 7.3.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Certificate System is an enterprise software system designed to
manage enterprise public key infrastructure (PKI) deployments. Simple
Certificate Enrollment Protocol (SCEP) is a PKI communication protocol
used to automatically enroll certificates for network devices.
The certificate authority allowed unauthenticated users to request the
one-time PIN in an SCEP request to be decrypted. An attacker able to sniff
an SCEP request from a network device could request the certificate
authority to decrypt the request, allowing them to obtain the one-time
PIN. With this update, the certificate authority only handles decryption
requests from authenticated registration authorities. (CVE-2010-3868)
The certificate authority allowed the one-time PIN used in SCEP requests
to be re-used. An attacker possessing a valid SCEP enrollment one-time PIN
could use it to generate an unlimited number of certificates.
(CVE-2010-3869)
The certificate authority used the MD5 hash algorithm to sign all SCEP
protocol responses. As MD5 is not collision resistant, an attacker could
use this flaw to perform an MD5 chosen-prefix collision attack to generate
attack-chosen output signed using the certificate authority's key.
(CVE-2004-2761)
This update also adds the following enhancements:
* Support for the stronger encryption algorithm Triple-DES (DES3), and
stronger hash algorithms SHA1, SHA256, and SHA512, for use in SCEP
communication. These algorithms are in addition to the previously supported
DES and MD5 algorithms.
* New configuration options for the SCEP server can define the default and
allowed encryption and hash algorithms. These options allow disabling uses
of the weaker algorithms not required by network devices and prevent
possible downgrade attacks. These can be configured by adding the following
options to the certificate authority's CS.cfg configuration file:
ca.scep.encryptionAlgorithm=DES3
ca.scep.allowedEncryptionAlgorithms=DES3
ca.scep.hashAlgorithm=SHA1
ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512
* With this update, the certificate authority's SCEP server is disabled by
default. The SCEP server can be enabled by adding the 'ca.scep.enable=true'
option to the certificate authority's CS.cfg configuration file.
* A separate key pair can now be configured for use in SCEP communication.
Previously, the main certificate authority's key pair was used for SCEP
communication too. A designated SCEP key pair can be referenced by adding
a new option, ca.scep.nickname=[scep certificate nickname], to the
certificate authority's CS.cfg configuration file.
* The certificate authority now allows the size of nonces used in SCEP
requests to be restricted by adding a new option, ca.scep.nonceSizeLimit=
[number of bytes], to the certificate authority's CS.cfg configuration
file. The limit is set to 16 bytes in the default CS.cfg configuration
file.
All users of Red Hat Certificate System 7.3 should upgrade to these updated
packages, which resolve these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated rhpki-ca, rhpki-common, and rhpki-util packages that fix three\nsecurity issues and add several enhancements are now available for Red Hat\nCertificate System 7.3.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", title: "Topic", }, { category: "general", text: "Red Hat Certificate System is an enterprise software system designed to\nmanage enterprise public key infrastructure (PKI) deployments. Simple\nCertificate Enrollment Protocol (SCEP) is a PKI communication protocol\nused to automatically enroll certificates for network devices.\n\nThe certificate authority allowed unauthenticated users to request the\none-time PIN in an SCEP request to be decrypted. An attacker able to sniff\nan SCEP request from a network device could request the certificate\nauthority to decrypt the request, allowing them to obtain the one-time\nPIN. With this update, the certificate authority only handles decryption\nrequests from authenticated registration authorities. (CVE-2010-3868)\n\nThe certificate authority allowed the one-time PIN used in SCEP requests\nto be re-used. An attacker possessing a valid SCEP enrollment one-time PIN\ncould use it to generate an unlimited number of certificates.\n(CVE-2010-3869)\n\nThe certificate authority used the MD5 hash algorithm to sign all SCEP\nprotocol responses. As MD5 is not collision resistant, an attacker could\nuse this flaw to perform an MD5 chosen-prefix collision attack to generate\nattack-chosen output signed using the certificate authority's key.\n(CVE-2004-2761)\n\nThis update also adds the following enhancements:\n\n* Support for the stronger encryption algorithm Triple-DES (DES3), and\nstronger hash algorithms SHA1, SHA256, and SHA512, for use in SCEP\ncommunication. These algorithms are in addition to the previously supported\nDES and MD5 algorithms.\n\n* New configuration options for the SCEP server can define the default and\nallowed encryption and hash algorithms. These options allow disabling uses\nof the weaker algorithms not required by network devices and prevent\npossible downgrade attacks. These can be configured by adding the following\noptions to the certificate authority's CS.cfg configuration file:\n\n ca.scep.encryptionAlgorithm=DES3\n ca.scep.allowedEncryptionAlgorithms=DES3\n ca.scep.hashAlgorithm=SHA1\n ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512\n\n* With this update, the certificate authority's SCEP server is disabled by\ndefault. The SCEP server can be enabled by adding the 'ca.scep.enable=true'\noption to the certificate authority's CS.cfg configuration file.\n\n* A separate key pair can now be configured for use in SCEP communication.\nPreviously, the main certificate authority's key pair was used for SCEP\ncommunication too. A designated SCEP key pair can be referenced by adding\na new option, ca.scep.nickname=[scep certificate nickname], to the\ncertificate authority's CS.cfg configuration file.\n\n* The certificate authority now allows the size of nonces used in SCEP\nrequests to be restricted by adding a new option, ca.scep.nonceSizeLimit=\n[number of bytes], to the certificate authority's CS.cfg configuration\nfile. The limit is set to 16 bytes in the default CS.cfg configuration\nfile.\n\nAll users of Red Hat Certificate System 7.3 should upgrade to these updated\npackages, which resolve these issues and add these enhancements.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2010:0837", url: "https://access.redhat.com/errata/RHSA-2010:0837", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0837.json", }, ], title: "Red Hat Security Advisory: rhpki security and enhancement update", tracking: { current_release_date: "2024-11-22T03:45:37+00:00", generator: { date: "2024-11-22T03:45:37+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2010:0837", initial_release_date: "2010-11-08T20:06:00+00:00", revision_history: [ { date: "2010-11-08T20:06:00+00:00", number: "1", summary: "Initial version", }, { date: "2010-11-08T15:06:51+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T03:45:37+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Certificate System 7.3 for 4AS", product: { name: "Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, { category: "product_name", name: "Red Hat Certificate System 7.3 for 4ES", product: { name: "Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, ], category: "product_family", name: "Red Hat Certificate System", }, { branches: [ { category: "product_version", name: "rhpki-ca-0:7.3.0-21.el4.noarch", product: { name: "rhpki-ca-0:7.3.0-21.el4.noarch", product_id: "rhpki-ca-0:7.3.0-21.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-ca@7.3.0-21.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-common-0:7.3.0-41.el4.noarch", product: { name: "rhpki-common-0:7.3.0-41.el4.noarch", product_id: "rhpki-common-0:7.3.0-41.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-common@7.3.0-41.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-util-0:7.3.0-21.el4.noarch", product: { name: "rhpki-util-0:7.3.0-21.el4.noarch", product_id: "rhpki-util-0:7.3.0-21.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-util@7.3.0-21.el4?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-common-0:7.3.0-41.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", }, product_reference: "rhpki-common-0:7.3.0-41.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-util-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-util-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-common-0:7.3.0-41.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", }, product_reference: "rhpki-common-0:7.3.0-41.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-util-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-util-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, ], }, vulnerabilities: [ { cve: "CVE-2004-2761", discovery_date: "2008-12-30T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648886", }, ], notes: [ { category: "description", text: "The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.", title: "Vulnerability description", }, { category: "summary", text: "MD5: MD5 Message-Digest Algorithm is not collision resistant", title: "Vulnerability summary", }, { category: "other", text: "Please see https://access.redhat.com/solutions/15378", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-2761", }, { category: "external", summary: "RHBZ#648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-2761", url: "https://www.cve.org/CVERecord?id=CVE-2004-2761", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", }, ], release_date: "2008-12-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:06:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0837", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "MD5: MD5 Message-Digest Algorithm is not collision resistant", }, { cve: "CVE-2010-3868", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648882", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.", title: "Vulnerability description", }, { category: "summary", text: "System: unauthenticated user can request SCEP one-time PIN decryption", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3868", }, { category: "external", summary: "RHBZ#648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3868", url: "https://www.cve.org/CVERecord?id=CVE-2010-3868", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:06:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0837", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:H/Au:N/C:P/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: unauthenticated user can request SCEP one-time PIN decryption", }, { cve: "CVE-2010-3869", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648883", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", title: "Vulnerability description", }, { category: "summary", text: "System: SCEP one-time PIN reuse", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3869", }, { category: "external", summary: "RHBZ#648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3869", url: "https://www.cve.org/CVERecord?id=CVE-2010-3869", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:06:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0837", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: SCEP one-time PIN reuse", }, ], }
rhsa-2010:0838
Vulnerability from csaf_redhat
Published
2010-11-08 20:09
Modified
2024-11-22 03:45
Summary
Red Hat Security Advisory: pki security and enhancement update
Notes
Topic
Updated pki-ca, pki-util, and pki-common packages that fix three security
issues and add several enhancements are now available for Red Hat
Certificate System 8.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Certificate System is an enterprise software system designed to
manage enterprise public key infrastructure (PKI) deployments. Simple
Certificate Enrollment Protocol (SCEP) is a PKI communication protocol
used to automatically enroll certificates for network devices.
The certificate authority allowed unauthenticated users to request the
one-time PIN in an SCEP request to be decrypted. An attacker able to sniff
an SCEP request from a network device could request the certificate
authority to decrypt the request, allowing them to obtain the one-time
PIN. With this update, the certificate authority only handles decryption
requests from authenticated registration authorities. (CVE-2010-3868)
The certificate authority allowed the one-time PIN used in SCEP requests
to be re-used. An attacker possessing a valid SCEP enrollment one-time PIN
could use it to generate an unlimited number of certificates.
(CVE-2010-3869)
The certificate authority used the MD5 hash algorithm to sign all SCEP
protocol responses. As MD5 is not collision resistant, an attacker could
use this flaw to perform an MD5 chosen-prefix collision attack to generate
attack-chosen output signed using the certificate authority's key.
(CVE-2004-2761)
This update also adds the following enhancements:
* New configuration options for the SCEP server can define the default and
allowed encryption and hash algorithms. These options allow disabling uses
of the weaker algorithms not required by network devices and prevent
possible downgrade attacks. These can be configured by adding the following
options to the certificate authority's CS.cfg configuration file:
ca.scep.encryptionAlgorithm=DES3
ca.scep.allowedEncryptionAlgorithms=DES3
ca.scep.hashAlgorithm=SHA1
ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512
* With this update, the certificate authority's SCEP server is disabled by
default. The SCEP server can be enabled by adding the 'ca.scep.enable=true'
option to the certificate authority's CS.cfg configuration file.
* A separate key pair can now be configured for use in SCEP communication.
Previously, the main certificate authority's key pair was used for SCEP
communication too. A designated SCEP key pair can be referenced by adding
a new option, ca.scep.nickname=[scep certificate nickname], to the
certificate authority's CS.cfg configuration file.
* The certificate authority now allows the size of nonces used in SCEP
requests to be restricted by adding a new option, ca.scep.nonceSizeLimit=
[number of bytes], to the certificate authority's CS.cfg configuration
file. The limit is set to 16 bytes in the default CS.cfg configuration
file.
All users of Red Hat Certificate System 8 should upgrade to these updated
packages, which resolve these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated pki-ca, pki-util, and pki-common packages that fix three security\nissues and add several enhancements are now available for Red Hat\nCertificate System 8.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", title: "Topic", }, { category: "general", text: "Red Hat Certificate System is an enterprise software system designed to\nmanage enterprise public key infrastructure (PKI) deployments. Simple\nCertificate Enrollment Protocol (SCEP) is a PKI communication protocol\nused to automatically enroll certificates for network devices.\n\nThe certificate authority allowed unauthenticated users to request the\none-time PIN in an SCEP request to be decrypted. An attacker able to sniff\nan SCEP request from a network device could request the certificate\nauthority to decrypt the request, allowing them to obtain the one-time\nPIN. With this update, the certificate authority only handles decryption\nrequests from authenticated registration authorities. (CVE-2010-3868)\n\nThe certificate authority allowed the one-time PIN used in SCEP requests\nto be re-used. An attacker possessing a valid SCEP enrollment one-time PIN\ncould use it to generate an unlimited number of certificates.\n(CVE-2010-3869)\n\nThe certificate authority used the MD5 hash algorithm to sign all SCEP\nprotocol responses. As MD5 is not collision resistant, an attacker could\nuse this flaw to perform an MD5 chosen-prefix collision attack to generate\nattack-chosen output signed using the certificate authority's key.\n(CVE-2004-2761)\n\nThis update also adds the following enhancements:\n\n* New configuration options for the SCEP server can define the default and\nallowed encryption and hash algorithms. These options allow disabling uses\nof the weaker algorithms not required by network devices and prevent\npossible downgrade attacks. These can be configured by adding the following\noptions to the certificate authority's CS.cfg configuration file:\n\n ca.scep.encryptionAlgorithm=DES3\n ca.scep.allowedEncryptionAlgorithms=DES3\n ca.scep.hashAlgorithm=SHA1\n ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512\n\n* With this update, the certificate authority's SCEP server is disabled by\ndefault. The SCEP server can be enabled by adding the 'ca.scep.enable=true'\noption to the certificate authority's CS.cfg configuration file.\n\n* A separate key pair can now be configured for use in SCEP communication.\nPreviously, the main certificate authority's key pair was used for SCEP\ncommunication too. A designated SCEP key pair can be referenced by adding\na new option, ca.scep.nickname=[scep certificate nickname], to the\ncertificate authority's CS.cfg configuration file.\n\n* The certificate authority now allows the size of nonces used in SCEP\nrequests to be restricted by adding a new option, ca.scep.nonceSizeLimit=\n[number of bytes], to the certificate authority's CS.cfg configuration\nfile. The limit is set to 16 bytes in the default CS.cfg configuration\nfile.\n\nAll users of Red Hat Certificate System 8 should upgrade to these updated\npackages, which resolve these issues and add these enhancements.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2010:0838", url: "https://access.redhat.com/errata/RHSA-2010:0838", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0838.json", }, ], title: "Red Hat Security Advisory: pki security and enhancement update", tracking: { current_release_date: "2024-11-22T03:45:42+00:00", generator: { date: "2024-11-22T03:45:42+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2010:0838", initial_release_date: "2010-11-08T20:09:00+00:00", revision_history: [ { date: "2010-11-08T20:09:00+00:00", number: "1", summary: "Initial version", }, { date: "2010-11-08T15:12:18+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T03:45:42+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Certificate System 8", product: { name: "Red Hat Certificate System 8", product_id: "5Server-RHCertSystem", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:8::el5", }, }, }, ], category: "product_family", name: "Red Hat Certificate System", }, { branches: [ { category: "product_version", name: "pki-ca-0:8.0.7-1.el5pki.src", product: { name: "pki-ca-0:8.0.7-1.el5pki.src", product_id: "pki-ca-0:8.0.7-1.el5pki.src", product_identification_helper: { purl: "pkg:rpm/redhat/pki-ca@8.0.7-1.el5pki?arch=src", }, }, }, { category: "product_version", name: "pki-util-0:8.0.5-1.el5pki.src", product: { name: "pki-util-0:8.0.5-1.el5pki.src", product_id: "pki-util-0:8.0.5-1.el5pki.src", product_identification_helper: { purl: "pkg:rpm/redhat/pki-util@8.0.5-1.el5pki?arch=src", }, }, }, { category: "product_version", name: "pki-common-0:8.0.6-2.el5pki.src", product: { name: "pki-common-0:8.0.6-2.el5pki.src", product_id: "pki-common-0:8.0.6-2.el5pki.src", product_identification_helper: { purl: "pkg:rpm/redhat/pki-common@8.0.6-2.el5pki?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "pki-ca-0:8.0.7-1.el5pki.noarch", product: { name: "pki-ca-0:8.0.7-1.el5pki.noarch", product_id: "pki-ca-0:8.0.7-1.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-ca@8.0.7-1.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-util-0:8.0.5-1.el5pki.noarch", product: { name: "pki-util-0:8.0.5-1.el5pki.noarch", product_id: "pki-util-0:8.0.5-1.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-util@8.0.5-1.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", product: { name: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", product_id: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-util-javadoc@8.0.5-1.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", product: { name: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", product_id: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-common-javadoc@8.0.6-2.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-common-0:8.0.6-2.el5pki.noarch", product: { name: "pki-common-0:8.0.6-2.el5pki.noarch", product_id: "pki-common-0:8.0.6-2.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-common@8.0.6-2.el5pki?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "pki-ca-0:8.0.7-1.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", }, product_reference: "pki-ca-0:8.0.7-1.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-ca-0:8.0.7-1.el5pki.src as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", }, product_reference: "pki-ca-0:8.0.7-1.el5pki.src", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-common-0:8.0.6-2.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", }, product_reference: "pki-common-0:8.0.6-2.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-common-0:8.0.6-2.el5pki.src as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", }, product_reference: "pki-common-0:8.0.6-2.el5pki.src", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", }, product_reference: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-util-0:8.0.5-1.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", }, product_reference: "pki-util-0:8.0.5-1.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-util-0:8.0.5-1.el5pki.src as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", }, product_reference: "pki-util-0:8.0.5-1.el5pki.src", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", }, product_reference: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, ], }, vulnerabilities: [ { cve: "CVE-2004-2761", discovery_date: "2008-12-30T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648886", }, ], notes: [ { category: "description", text: "The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.", title: "Vulnerability description", }, { category: "summary", text: "MD5: MD5 Message-Digest Algorithm is not collision resistant", title: "Vulnerability summary", }, { category: "other", text: "Please see https://access.redhat.com/solutions/15378", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-2761", }, { category: "external", summary: "RHBZ#648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-2761", url: "https://www.cve.org/CVERecord?id=CVE-2004-2761", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", }, ], release_date: "2008-12-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:09:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0838", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, products: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "MD5: MD5 Message-Digest Algorithm is not collision resistant", }, { cve: "CVE-2010-3868", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648882", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.", title: "Vulnerability description", }, { category: "summary", text: "System: unauthenticated user can request SCEP one-time PIN decryption", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3868", }, { category: "external", summary: "RHBZ#648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3868", url: "https://www.cve.org/CVERecord?id=CVE-2010-3868", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:09:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0838", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:H/Au:N/C:P/I:P/A:N", version: "2.0", }, products: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: unauthenticated user can request SCEP one-time PIN decryption", }, { cve: "CVE-2010-3869", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648883", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", title: "Vulnerability description", }, { category: "summary", text: "System: SCEP one-time PIN reuse", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3869", }, { category: "external", summary: "RHBZ#648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3869", url: "https://www.cve.org/CVERecord?id=CVE-2010-3869", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:09:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0838", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N", version: "2.0", }, products: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: SCEP one-time PIN reuse", }, ], }
RHSA-2010:0837
Vulnerability from csaf_redhat
Published
2010-11-08 20:06
Modified
2024-11-22 03:45
Summary
Red Hat Security Advisory: rhpki security and enhancement update
Notes
Topic
Updated rhpki-ca, rhpki-common, and rhpki-util packages that fix three
security issues and add several enhancements are now available for Red Hat
Certificate System 7.3.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Certificate System is an enterprise software system designed to
manage enterprise public key infrastructure (PKI) deployments. Simple
Certificate Enrollment Protocol (SCEP) is a PKI communication protocol
used to automatically enroll certificates for network devices.
The certificate authority allowed unauthenticated users to request the
one-time PIN in an SCEP request to be decrypted. An attacker able to sniff
an SCEP request from a network device could request the certificate
authority to decrypt the request, allowing them to obtain the one-time
PIN. With this update, the certificate authority only handles decryption
requests from authenticated registration authorities. (CVE-2010-3868)
The certificate authority allowed the one-time PIN used in SCEP requests
to be re-used. An attacker possessing a valid SCEP enrollment one-time PIN
could use it to generate an unlimited number of certificates.
(CVE-2010-3869)
The certificate authority used the MD5 hash algorithm to sign all SCEP
protocol responses. As MD5 is not collision resistant, an attacker could
use this flaw to perform an MD5 chosen-prefix collision attack to generate
attack-chosen output signed using the certificate authority's key.
(CVE-2004-2761)
This update also adds the following enhancements:
* Support for the stronger encryption algorithm Triple-DES (DES3), and
stronger hash algorithms SHA1, SHA256, and SHA512, for use in SCEP
communication. These algorithms are in addition to the previously supported
DES and MD5 algorithms.
* New configuration options for the SCEP server can define the default and
allowed encryption and hash algorithms. These options allow disabling uses
of the weaker algorithms not required by network devices and prevent
possible downgrade attacks. These can be configured by adding the following
options to the certificate authority's CS.cfg configuration file:
ca.scep.encryptionAlgorithm=DES3
ca.scep.allowedEncryptionAlgorithms=DES3
ca.scep.hashAlgorithm=SHA1
ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512
* With this update, the certificate authority's SCEP server is disabled by
default. The SCEP server can be enabled by adding the 'ca.scep.enable=true'
option to the certificate authority's CS.cfg configuration file.
* A separate key pair can now be configured for use in SCEP communication.
Previously, the main certificate authority's key pair was used for SCEP
communication too. A designated SCEP key pair can be referenced by adding
a new option, ca.scep.nickname=[scep certificate nickname], to the
certificate authority's CS.cfg configuration file.
* The certificate authority now allows the size of nonces used in SCEP
requests to be restricted by adding a new option, ca.scep.nonceSizeLimit=
[number of bytes], to the certificate authority's CS.cfg configuration
file. The limit is set to 16 bytes in the default CS.cfg configuration
file.
All users of Red Hat Certificate System 7.3 should upgrade to these updated
packages, which resolve these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated rhpki-ca, rhpki-common, and rhpki-util packages that fix three\nsecurity issues and add several enhancements are now available for Red Hat\nCertificate System 7.3.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", title: "Topic", }, { category: "general", text: "Red Hat Certificate System is an enterprise software system designed to\nmanage enterprise public key infrastructure (PKI) deployments. Simple\nCertificate Enrollment Protocol (SCEP) is a PKI communication protocol\nused to automatically enroll certificates for network devices.\n\nThe certificate authority allowed unauthenticated users to request the\none-time PIN in an SCEP request to be decrypted. An attacker able to sniff\nan SCEP request from a network device could request the certificate\nauthority to decrypt the request, allowing them to obtain the one-time\nPIN. With this update, the certificate authority only handles decryption\nrequests from authenticated registration authorities. (CVE-2010-3868)\n\nThe certificate authority allowed the one-time PIN used in SCEP requests\nto be re-used. An attacker possessing a valid SCEP enrollment one-time PIN\ncould use it to generate an unlimited number of certificates.\n(CVE-2010-3869)\n\nThe certificate authority used the MD5 hash algorithm to sign all SCEP\nprotocol responses. As MD5 is not collision resistant, an attacker could\nuse this flaw to perform an MD5 chosen-prefix collision attack to generate\nattack-chosen output signed using the certificate authority's key.\n(CVE-2004-2761)\n\nThis update also adds the following enhancements:\n\n* Support for the stronger encryption algorithm Triple-DES (DES3), and\nstronger hash algorithms SHA1, SHA256, and SHA512, for use in SCEP\ncommunication. These algorithms are in addition to the previously supported\nDES and MD5 algorithms.\n\n* New configuration options for the SCEP server can define the default and\nallowed encryption and hash algorithms. These options allow disabling uses\nof the weaker algorithms not required by network devices and prevent\npossible downgrade attacks. These can be configured by adding the following\noptions to the certificate authority's CS.cfg configuration file:\n\n ca.scep.encryptionAlgorithm=DES3\n ca.scep.allowedEncryptionAlgorithms=DES3\n ca.scep.hashAlgorithm=SHA1\n ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512\n\n* With this update, the certificate authority's SCEP server is disabled by\ndefault. The SCEP server can be enabled by adding the 'ca.scep.enable=true'\noption to the certificate authority's CS.cfg configuration file.\n\n* A separate key pair can now be configured for use in SCEP communication.\nPreviously, the main certificate authority's key pair was used for SCEP\ncommunication too. A designated SCEP key pair can be referenced by adding\na new option, ca.scep.nickname=[scep certificate nickname], to the\ncertificate authority's CS.cfg configuration file.\n\n* The certificate authority now allows the size of nonces used in SCEP\nrequests to be restricted by adding a new option, ca.scep.nonceSizeLimit=\n[number of bytes], to the certificate authority's CS.cfg configuration\nfile. The limit is set to 16 bytes in the default CS.cfg configuration\nfile.\n\nAll users of Red Hat Certificate System 7.3 should upgrade to these updated\npackages, which resolve these issues and add these enhancements.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2010:0837", url: "https://access.redhat.com/errata/RHSA-2010:0837", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0837.json", }, ], title: "Red Hat Security Advisory: rhpki security and enhancement update", tracking: { current_release_date: "2024-11-22T03:45:37+00:00", generator: { date: "2024-11-22T03:45:37+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2010:0837", initial_release_date: "2010-11-08T20:06:00+00:00", revision_history: [ { date: "2010-11-08T20:06:00+00:00", number: "1", summary: "Initial version", }, { date: "2010-11-08T15:06:51+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T03:45:37+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Certificate System 7.3 for 4AS", product: { name: "Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, { category: "product_name", name: "Red Hat Certificate System 7.3 for 4ES", product: { name: "Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:7.3", }, }, }, ], category: "product_family", name: "Red Hat Certificate System", }, { branches: [ { category: "product_version", name: "rhpki-ca-0:7.3.0-21.el4.noarch", product: { name: "rhpki-ca-0:7.3.0-21.el4.noarch", product_id: "rhpki-ca-0:7.3.0-21.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-ca@7.3.0-21.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-common-0:7.3.0-41.el4.noarch", product: { name: "rhpki-common-0:7.3.0-41.el4.noarch", product_id: "rhpki-common-0:7.3.0-41.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-common@7.3.0-41.el4?arch=noarch", }, }, }, { category: "product_version", name: "rhpki-util-0:7.3.0-21.el4.noarch", product: { name: "rhpki-util-0:7.3.0-21.el4.noarch", product_id: "rhpki-util-0:7.3.0-21.el4.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/rhpki-util@7.3.0-21.el4?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-common-0:7.3.0-41.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", }, product_reference: "rhpki-common-0:7.3.0-41.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-util-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4AS", product_id: "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-util-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4AS-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-ca-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-ca-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-common-0:7.3.0-41.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", }, product_reference: "rhpki-common-0:7.3.0-41.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, { category: "default_component_of", full_product_name: { name: "rhpki-util-0:7.3.0-21.el4.noarch as a component of Red Hat Certificate System 7.3 for 4ES", product_id: "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", }, product_reference: "rhpki-util-0:7.3.0-21.el4.noarch", relates_to_product_reference: "4ES-CERT-7.3", }, ], }, vulnerabilities: [ { cve: "CVE-2004-2761", discovery_date: "2008-12-30T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648886", }, ], notes: [ { category: "description", text: "The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.", title: "Vulnerability description", }, { category: "summary", text: "MD5: MD5 Message-Digest Algorithm is not collision resistant", title: "Vulnerability summary", }, { category: "other", text: "Please see https://access.redhat.com/solutions/15378", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-2761", }, { category: "external", summary: "RHBZ#648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-2761", url: "https://www.cve.org/CVERecord?id=CVE-2004-2761", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", }, ], release_date: "2008-12-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:06:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0837", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "MD5: MD5 Message-Digest Algorithm is not collision resistant", }, { cve: "CVE-2010-3868", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648882", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.", title: "Vulnerability description", }, { category: "summary", text: "System: unauthenticated user can request SCEP one-time PIN decryption", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3868", }, { category: "external", summary: "RHBZ#648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3868", url: "https://www.cve.org/CVERecord?id=CVE-2010-3868", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:06:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0837", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:H/Au:N/C:P/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: unauthenticated user can request SCEP one-time PIN decryption", }, { cve: "CVE-2010-3869", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648883", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", title: "Vulnerability description", }, { category: "summary", text: "System: SCEP one-time PIN reuse", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3869", }, { category: "external", summary: "RHBZ#648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3869", url: "https://www.cve.org/CVERecord?id=CVE-2010-3869", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:06:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0837", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N", version: "2.0", }, products: [ "4AS-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4AS-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4AS-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-ca-0:7.3.0-21.el4.noarch", "4ES-CERT-7.3:rhpki-common-0:7.3.0-41.el4.noarch", "4ES-CERT-7.3:rhpki-util-0:7.3.0-21.el4.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: SCEP one-time PIN reuse", }, ], }
rhsa-2010_0838
Vulnerability from csaf_redhat
Published
2010-11-08 20:09
Modified
2024-11-22 03:45
Summary
Red Hat Security Advisory: pki security and enhancement update
Notes
Topic
Updated pki-ca, pki-util, and pki-common packages that fix three security
issues and add several enhancements are now available for Red Hat
Certificate System 8.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Certificate System is an enterprise software system designed to
manage enterprise public key infrastructure (PKI) deployments. Simple
Certificate Enrollment Protocol (SCEP) is a PKI communication protocol
used to automatically enroll certificates for network devices.
The certificate authority allowed unauthenticated users to request the
one-time PIN in an SCEP request to be decrypted. An attacker able to sniff
an SCEP request from a network device could request the certificate
authority to decrypt the request, allowing them to obtain the one-time
PIN. With this update, the certificate authority only handles decryption
requests from authenticated registration authorities. (CVE-2010-3868)
The certificate authority allowed the one-time PIN used in SCEP requests
to be re-used. An attacker possessing a valid SCEP enrollment one-time PIN
could use it to generate an unlimited number of certificates.
(CVE-2010-3869)
The certificate authority used the MD5 hash algorithm to sign all SCEP
protocol responses. As MD5 is not collision resistant, an attacker could
use this flaw to perform an MD5 chosen-prefix collision attack to generate
attack-chosen output signed using the certificate authority's key.
(CVE-2004-2761)
This update also adds the following enhancements:
* New configuration options for the SCEP server can define the default and
allowed encryption and hash algorithms. These options allow disabling uses
of the weaker algorithms not required by network devices and prevent
possible downgrade attacks. These can be configured by adding the following
options to the certificate authority's CS.cfg configuration file:
ca.scep.encryptionAlgorithm=DES3
ca.scep.allowedEncryptionAlgorithms=DES3
ca.scep.hashAlgorithm=SHA1
ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512
* With this update, the certificate authority's SCEP server is disabled by
default. The SCEP server can be enabled by adding the 'ca.scep.enable=true'
option to the certificate authority's CS.cfg configuration file.
* A separate key pair can now be configured for use in SCEP communication.
Previously, the main certificate authority's key pair was used for SCEP
communication too. A designated SCEP key pair can be referenced by adding
a new option, ca.scep.nickname=[scep certificate nickname], to the
certificate authority's CS.cfg configuration file.
* The certificate authority now allows the size of nonces used in SCEP
requests to be restricted by adding a new option, ca.scep.nonceSizeLimit=
[number of bytes], to the certificate authority's CS.cfg configuration
file. The limit is set to 16 bytes in the default CS.cfg configuration
file.
All users of Red Hat Certificate System 8 should upgrade to these updated
packages, which resolve these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated pki-ca, pki-util, and pki-common packages that fix three security\nissues and add several enhancements are now available for Red Hat\nCertificate System 8.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", title: "Topic", }, { category: "general", text: "Red Hat Certificate System is an enterprise software system designed to\nmanage enterprise public key infrastructure (PKI) deployments. Simple\nCertificate Enrollment Protocol (SCEP) is a PKI communication protocol\nused to automatically enroll certificates for network devices.\n\nThe certificate authority allowed unauthenticated users to request the\none-time PIN in an SCEP request to be decrypted. An attacker able to sniff\nan SCEP request from a network device could request the certificate\nauthority to decrypt the request, allowing them to obtain the one-time\nPIN. With this update, the certificate authority only handles decryption\nrequests from authenticated registration authorities. (CVE-2010-3868)\n\nThe certificate authority allowed the one-time PIN used in SCEP requests\nto be re-used. An attacker possessing a valid SCEP enrollment one-time PIN\ncould use it to generate an unlimited number of certificates.\n(CVE-2010-3869)\n\nThe certificate authority used the MD5 hash algorithm to sign all SCEP\nprotocol responses. As MD5 is not collision resistant, an attacker could\nuse this flaw to perform an MD5 chosen-prefix collision attack to generate\nattack-chosen output signed using the certificate authority's key.\n(CVE-2004-2761)\n\nThis update also adds the following enhancements:\n\n* New configuration options for the SCEP server can define the default and\nallowed encryption and hash algorithms. These options allow disabling uses\nof the weaker algorithms not required by network devices and prevent\npossible downgrade attacks. These can be configured by adding the following\noptions to the certificate authority's CS.cfg configuration file:\n\n ca.scep.encryptionAlgorithm=DES3\n ca.scep.allowedEncryptionAlgorithms=DES3\n ca.scep.hashAlgorithm=SHA1\n ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512\n\n* With this update, the certificate authority's SCEP server is disabled by\ndefault. The SCEP server can be enabled by adding the 'ca.scep.enable=true'\noption to the certificate authority's CS.cfg configuration file.\n\n* A separate key pair can now be configured for use in SCEP communication.\nPreviously, the main certificate authority's key pair was used for SCEP\ncommunication too. A designated SCEP key pair can be referenced by adding\na new option, ca.scep.nickname=[scep certificate nickname], to the\ncertificate authority's CS.cfg configuration file.\n\n* The certificate authority now allows the size of nonces used in SCEP\nrequests to be restricted by adding a new option, ca.scep.nonceSizeLimit=\n[number of bytes], to the certificate authority's CS.cfg configuration\nfile. The limit is set to 16 bytes in the default CS.cfg configuration\nfile.\n\nAll users of Red Hat Certificate System 8 should upgrade to these updated\npackages, which resolve these issues and add these enhancements.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2010:0838", url: "https://access.redhat.com/errata/RHSA-2010:0838", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0838.json", }, ], title: "Red Hat Security Advisory: pki security and enhancement update", tracking: { current_release_date: "2024-11-22T03:45:42+00:00", generator: { date: "2024-11-22T03:45:42+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2010:0838", initial_release_date: "2010-11-08T20:09:00+00:00", revision_history: [ { date: "2010-11-08T20:09:00+00:00", number: "1", summary: "Initial version", }, { date: "2010-11-08T15:12:18+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T03:45:42+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Certificate System 8", product: { name: "Red Hat Certificate System 8", product_id: "5Server-RHCertSystem", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:8::el5", }, }, }, ], category: "product_family", name: "Red Hat Certificate System", }, { branches: [ { category: "product_version", name: "pki-ca-0:8.0.7-1.el5pki.src", product: { name: "pki-ca-0:8.0.7-1.el5pki.src", product_id: "pki-ca-0:8.0.7-1.el5pki.src", product_identification_helper: { purl: "pkg:rpm/redhat/pki-ca@8.0.7-1.el5pki?arch=src", }, }, }, { category: "product_version", name: "pki-util-0:8.0.5-1.el5pki.src", product: { name: "pki-util-0:8.0.5-1.el5pki.src", product_id: "pki-util-0:8.0.5-1.el5pki.src", product_identification_helper: { purl: "pkg:rpm/redhat/pki-util@8.0.5-1.el5pki?arch=src", }, }, }, { category: "product_version", name: "pki-common-0:8.0.6-2.el5pki.src", product: { name: "pki-common-0:8.0.6-2.el5pki.src", product_id: "pki-common-0:8.0.6-2.el5pki.src", product_identification_helper: { purl: "pkg:rpm/redhat/pki-common@8.0.6-2.el5pki?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "pki-ca-0:8.0.7-1.el5pki.noarch", product: { name: "pki-ca-0:8.0.7-1.el5pki.noarch", product_id: "pki-ca-0:8.0.7-1.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-ca@8.0.7-1.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-util-0:8.0.5-1.el5pki.noarch", product: { name: "pki-util-0:8.0.5-1.el5pki.noarch", product_id: "pki-util-0:8.0.5-1.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-util@8.0.5-1.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", product: { name: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", product_id: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-util-javadoc@8.0.5-1.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", product: { name: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", product_id: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-common-javadoc@8.0.6-2.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-common-0:8.0.6-2.el5pki.noarch", product: { name: "pki-common-0:8.0.6-2.el5pki.noarch", product_id: "pki-common-0:8.0.6-2.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-common@8.0.6-2.el5pki?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "pki-ca-0:8.0.7-1.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", }, product_reference: "pki-ca-0:8.0.7-1.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-ca-0:8.0.7-1.el5pki.src as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", }, product_reference: "pki-ca-0:8.0.7-1.el5pki.src", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-common-0:8.0.6-2.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", }, product_reference: "pki-common-0:8.0.6-2.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-common-0:8.0.6-2.el5pki.src as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", }, product_reference: "pki-common-0:8.0.6-2.el5pki.src", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", }, product_reference: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-util-0:8.0.5-1.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", }, product_reference: "pki-util-0:8.0.5-1.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-util-0:8.0.5-1.el5pki.src as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", }, product_reference: "pki-util-0:8.0.5-1.el5pki.src", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", }, product_reference: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, ], }, vulnerabilities: [ { cve: "CVE-2004-2761", discovery_date: "2008-12-30T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648886", }, ], notes: [ { category: "description", text: "The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.", title: "Vulnerability description", }, { category: "summary", text: "MD5: MD5 Message-Digest Algorithm is not collision resistant", title: "Vulnerability summary", }, { category: "other", text: "Please see https://access.redhat.com/solutions/15378", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-2761", }, { category: "external", summary: "RHBZ#648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-2761", url: "https://www.cve.org/CVERecord?id=CVE-2004-2761", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", }, ], release_date: "2008-12-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:09:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0838", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, products: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "MD5: MD5 Message-Digest Algorithm is not collision resistant", }, { cve: "CVE-2010-3868", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648882", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.", title: "Vulnerability description", }, { category: "summary", text: "System: unauthenticated user can request SCEP one-time PIN decryption", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3868", }, { category: "external", summary: "RHBZ#648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3868", url: "https://www.cve.org/CVERecord?id=CVE-2010-3868", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:09:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0838", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:H/Au:N/C:P/I:P/A:N", version: "2.0", }, products: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: unauthenticated user can request SCEP one-time PIN decryption", }, { cve: "CVE-2010-3869", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648883", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", title: "Vulnerability description", }, { category: "summary", text: "System: SCEP one-time PIN reuse", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3869", }, { category: "external", summary: "RHBZ#648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3869", url: "https://www.cve.org/CVERecord?id=CVE-2010-3869", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:09:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0838", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N", version: "2.0", }, products: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: SCEP one-time PIN reuse", }, ], }
RHSA-2010:0838
Vulnerability from csaf_redhat
Published
2010-11-08 20:09
Modified
2024-11-22 03:45
Summary
Red Hat Security Advisory: pki security and enhancement update
Notes
Topic
Updated pki-ca, pki-util, and pki-common packages that fix three security
issues and add several enhancements are now available for Red Hat
Certificate System 8.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Certificate System is an enterprise software system designed to
manage enterprise public key infrastructure (PKI) deployments. Simple
Certificate Enrollment Protocol (SCEP) is a PKI communication protocol
used to automatically enroll certificates for network devices.
The certificate authority allowed unauthenticated users to request the
one-time PIN in an SCEP request to be decrypted. An attacker able to sniff
an SCEP request from a network device could request the certificate
authority to decrypt the request, allowing them to obtain the one-time
PIN. With this update, the certificate authority only handles decryption
requests from authenticated registration authorities. (CVE-2010-3868)
The certificate authority allowed the one-time PIN used in SCEP requests
to be re-used. An attacker possessing a valid SCEP enrollment one-time PIN
could use it to generate an unlimited number of certificates.
(CVE-2010-3869)
The certificate authority used the MD5 hash algorithm to sign all SCEP
protocol responses. As MD5 is not collision resistant, an attacker could
use this flaw to perform an MD5 chosen-prefix collision attack to generate
attack-chosen output signed using the certificate authority's key.
(CVE-2004-2761)
This update also adds the following enhancements:
* New configuration options for the SCEP server can define the default and
allowed encryption and hash algorithms. These options allow disabling uses
of the weaker algorithms not required by network devices and prevent
possible downgrade attacks. These can be configured by adding the following
options to the certificate authority's CS.cfg configuration file:
ca.scep.encryptionAlgorithm=DES3
ca.scep.allowedEncryptionAlgorithms=DES3
ca.scep.hashAlgorithm=SHA1
ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512
* With this update, the certificate authority's SCEP server is disabled by
default. The SCEP server can be enabled by adding the 'ca.scep.enable=true'
option to the certificate authority's CS.cfg configuration file.
* A separate key pair can now be configured for use in SCEP communication.
Previously, the main certificate authority's key pair was used for SCEP
communication too. A designated SCEP key pair can be referenced by adding
a new option, ca.scep.nickname=[scep certificate nickname], to the
certificate authority's CS.cfg configuration file.
* The certificate authority now allows the size of nonces used in SCEP
requests to be restricted by adding a new option, ca.scep.nonceSizeLimit=
[number of bytes], to the certificate authority's CS.cfg configuration
file. The limit is set to 16 bytes in the default CS.cfg configuration
file.
All users of Red Hat Certificate System 8 should upgrade to these updated
packages, which resolve these issues and add these enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ document: { aggregate_severity: { namespace: "https://access.redhat.com/security/updates/classification/", text: "Moderate", }, category: "csaf_security_advisory", csaf_version: "2.0", distribution: { text: "Copyright © Red Hat, Inc. All rights reserved.", tlp: { label: "WHITE", url: "https://www.first.org/tlp/", }, }, lang: "en", notes: [ { category: "summary", text: "Updated pki-ca, pki-util, and pki-common packages that fix three security\nissues and add several enhancements are now available for Red Hat\nCertificate System 8.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", title: "Topic", }, { category: "general", text: "Red Hat Certificate System is an enterprise software system designed to\nmanage enterprise public key infrastructure (PKI) deployments. Simple\nCertificate Enrollment Protocol (SCEP) is a PKI communication protocol\nused to automatically enroll certificates for network devices.\n\nThe certificate authority allowed unauthenticated users to request the\none-time PIN in an SCEP request to be decrypted. An attacker able to sniff\nan SCEP request from a network device could request the certificate\nauthority to decrypt the request, allowing them to obtain the one-time\nPIN. With this update, the certificate authority only handles decryption\nrequests from authenticated registration authorities. (CVE-2010-3868)\n\nThe certificate authority allowed the one-time PIN used in SCEP requests\nto be re-used. An attacker possessing a valid SCEP enrollment one-time PIN\ncould use it to generate an unlimited number of certificates.\n(CVE-2010-3869)\n\nThe certificate authority used the MD5 hash algorithm to sign all SCEP\nprotocol responses. As MD5 is not collision resistant, an attacker could\nuse this flaw to perform an MD5 chosen-prefix collision attack to generate\nattack-chosen output signed using the certificate authority's key.\n(CVE-2004-2761)\n\nThis update also adds the following enhancements:\n\n* New configuration options for the SCEP server can define the default and\nallowed encryption and hash algorithms. These options allow disabling uses\nof the weaker algorithms not required by network devices and prevent\npossible downgrade attacks. These can be configured by adding the following\noptions to the certificate authority's CS.cfg configuration file:\n\n ca.scep.encryptionAlgorithm=DES3\n ca.scep.allowedEncryptionAlgorithms=DES3\n ca.scep.hashAlgorithm=SHA1\n ca.scep.allowedHashAlgorithms=SHA1,SHA256,SHA512\n\n* With this update, the certificate authority's SCEP server is disabled by\ndefault. The SCEP server can be enabled by adding the 'ca.scep.enable=true'\noption to the certificate authority's CS.cfg configuration file.\n\n* A separate key pair can now be configured for use in SCEP communication.\nPreviously, the main certificate authority's key pair was used for SCEP\ncommunication too. A designated SCEP key pair can be referenced by adding\na new option, ca.scep.nickname=[scep certificate nickname], to the\ncertificate authority's CS.cfg configuration file.\n\n* The certificate authority now allows the size of nonces used in SCEP\nrequests to be restricted by adding a new option, ca.scep.nonceSizeLimit=\n[number of bytes], to the certificate authority's CS.cfg configuration\nfile. The limit is set to 16 bytes in the default CS.cfg configuration\nfile.\n\nAll users of Red Hat Certificate System 8 should upgrade to these updated\npackages, which resolve these issues and add these enhancements.", title: "Details", }, { category: "legal_disclaimer", text: "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", title: "Terms of Use", }, ], publisher: { category: "vendor", contact_details: "https://access.redhat.com/security/team/contact/", issuing_authority: "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", name: "Red Hat Product Security", namespace: "https://www.redhat.com", }, references: [ { category: "self", summary: "https://access.redhat.com/errata/RHSA-2010:0838", url: "https://access.redhat.com/errata/RHSA-2010:0838", }, { category: "external", summary: "https://access.redhat.com/security/updates/classification/#moderate", url: "https://access.redhat.com/security/updates/classification/#moderate", }, { category: "external", summary: "648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "self", summary: "Canonical URL", url: "https://security.access.redhat.com/data/csaf/v2/advisories/2010/rhsa-2010_0838.json", }, ], title: "Red Hat Security Advisory: pki security and enhancement update", tracking: { current_release_date: "2024-11-22T03:45:42+00:00", generator: { date: "2024-11-22T03:45:42+00:00", engine: { name: "Red Hat SDEngine", version: "4.2.1", }, }, id: "RHSA-2010:0838", initial_release_date: "2010-11-08T20:09:00+00:00", revision_history: [ { date: "2010-11-08T20:09:00+00:00", number: "1", summary: "Initial version", }, { date: "2010-11-08T15:12:18+00:00", number: "2", summary: "Last updated version", }, { date: "2024-11-22T03:45:42+00:00", number: "3", summary: "Last generated version", }, ], status: "final", version: "3", }, }, product_tree: { branches: [ { branches: [ { branches: [ { category: "product_name", name: "Red Hat Certificate System 8", product: { name: "Red Hat Certificate System 8", product_id: "5Server-RHCertSystem", product_identification_helper: { cpe: "cpe:/a:redhat:certificate_system:8::el5", }, }, }, ], category: "product_family", name: "Red Hat Certificate System", }, { branches: [ { category: "product_version", name: "pki-ca-0:8.0.7-1.el5pki.src", product: { name: "pki-ca-0:8.0.7-1.el5pki.src", product_id: "pki-ca-0:8.0.7-1.el5pki.src", product_identification_helper: { purl: "pkg:rpm/redhat/pki-ca@8.0.7-1.el5pki?arch=src", }, }, }, { category: "product_version", name: "pki-util-0:8.0.5-1.el5pki.src", product: { name: "pki-util-0:8.0.5-1.el5pki.src", product_id: "pki-util-0:8.0.5-1.el5pki.src", product_identification_helper: { purl: "pkg:rpm/redhat/pki-util@8.0.5-1.el5pki?arch=src", }, }, }, { category: "product_version", name: "pki-common-0:8.0.6-2.el5pki.src", product: { name: "pki-common-0:8.0.6-2.el5pki.src", product_id: "pki-common-0:8.0.6-2.el5pki.src", product_identification_helper: { purl: "pkg:rpm/redhat/pki-common@8.0.6-2.el5pki?arch=src", }, }, }, ], category: "architecture", name: "src", }, { branches: [ { category: "product_version", name: "pki-ca-0:8.0.7-1.el5pki.noarch", product: { name: "pki-ca-0:8.0.7-1.el5pki.noarch", product_id: "pki-ca-0:8.0.7-1.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-ca@8.0.7-1.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-util-0:8.0.5-1.el5pki.noarch", product: { name: "pki-util-0:8.0.5-1.el5pki.noarch", product_id: "pki-util-0:8.0.5-1.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-util@8.0.5-1.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", product: { name: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", product_id: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-util-javadoc@8.0.5-1.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", product: { name: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", product_id: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-common-javadoc@8.0.6-2.el5pki?arch=noarch", }, }, }, { category: "product_version", name: "pki-common-0:8.0.6-2.el5pki.noarch", product: { name: "pki-common-0:8.0.6-2.el5pki.noarch", product_id: "pki-common-0:8.0.6-2.el5pki.noarch", product_identification_helper: { purl: "pkg:rpm/redhat/pki-common@8.0.6-2.el5pki?arch=noarch", }, }, }, ], category: "architecture", name: "noarch", }, ], category: "vendor", name: "Red Hat", }, ], relationships: [ { category: "default_component_of", full_product_name: { name: "pki-ca-0:8.0.7-1.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", }, product_reference: "pki-ca-0:8.0.7-1.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-ca-0:8.0.7-1.el5pki.src as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", }, product_reference: "pki-ca-0:8.0.7-1.el5pki.src", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-common-0:8.0.6-2.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", }, product_reference: "pki-common-0:8.0.6-2.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-common-0:8.0.6-2.el5pki.src as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", }, product_reference: "pki-common-0:8.0.6-2.el5pki.src", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", }, product_reference: "pki-common-javadoc-0:8.0.6-2.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-util-0:8.0.5-1.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", }, product_reference: "pki-util-0:8.0.5-1.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-util-0:8.0.5-1.el5pki.src as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", }, product_reference: "pki-util-0:8.0.5-1.el5pki.src", relates_to_product_reference: "5Server-RHCertSystem", }, { category: "default_component_of", full_product_name: { name: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch as a component of Red Hat Certificate System 8", product_id: "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", }, product_reference: "pki-util-javadoc-0:8.0.5-1.el5pki.noarch", relates_to_product_reference: "5Server-RHCertSystem", }, ], }, vulnerabilities: [ { cve: "CVE-2004-2761", discovery_date: "2008-12-30T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648886", }, ], notes: [ { category: "description", text: "The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.", title: "Vulnerability description", }, { category: "summary", text: "MD5: MD5 Message-Digest Algorithm is not collision resistant", title: "Vulnerability summary", }, { category: "other", text: "Please see https://access.redhat.com/solutions/15378", title: "Statement", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2004-2761", }, { category: "external", summary: "RHBZ#648886", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648886", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2004-2761", url: "https://www.cve.org/CVERecord?id=CVE-2004-2761", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", url: "https://nvd.nist.gov/vuln/detail/CVE-2004-2761", }, ], release_date: "2008-12-30T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:09:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0838", }, ], scores: [ { cvss_v2: { accessComplexity: "MEDIUM", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4.3, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:M/Au:N/C:N/I:P/A:N", version: "2.0", }, products: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "MD5: MD5 Message-Digest Algorithm is not collision resistant", }, { cve: "CVE-2010-3868", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648882", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.", title: "Vulnerability description", }, { category: "summary", text: "System: unauthenticated user can request SCEP one-time PIN decryption", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3868", }, { category: "external", summary: "RHBZ#648882", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648882", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3868", url: "https://www.cve.org/CVERecord?id=CVE-2010-3868", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3868", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:09:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0838", }, ], scores: [ { cvss_v2: { accessComplexity: "HIGH", accessVector: "NETWORK", authentication: "NONE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "PARTIAL", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:H/Au:N/C:P/I:P/A:N", version: "2.0", }, products: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: unauthenticated user can request SCEP one-time PIN decryption", }, { cve: "CVE-2010-3869", discovery_date: "2008-11-10T00:00:00+00:00", ids: [ { system_name: "Red Hat Bugzilla ID", text: "648883", }, ], notes: [ { category: "description", text: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", title: "Vulnerability description", }, { category: "summary", text: "System: SCEP one-time PIN reuse", title: "Vulnerability summary", }, { category: "general", text: "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", title: "CVSS score applicability", }, ], product_status: { fixed: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, references: [ { category: "self", summary: "Canonical URL", url: "https://access.redhat.com/security/cve/CVE-2010-3869", }, { category: "external", summary: "RHBZ#648883", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { category: "external", summary: "https://www.cve.org/CVERecord?id=CVE-2010-3869", url: "https://www.cve.org/CVERecord?id=CVE-2010-3869", }, { category: "external", summary: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", }, ], release_date: "2010-11-08T00:00:00+00:00", remediations: [ { category: "vendor_fix", date: "2010-11-08T20:09:00+00:00", details: "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/docs/DOC-11259", product_ids: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], restart_required: { category: "none", }, url: "https://access.redhat.com/errata/RHSA-2010:0838", }, ], scores: [ { cvss_v2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N", version: "2.0", }, products: [ "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.noarch", "5Server-RHCertSystem:pki-ca-0:8.0.7-1.el5pki.src", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-common-0:8.0.6-2.el5pki.src", "5Server-RHCertSystem:pki-common-javadoc-0:8.0.6-2.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.noarch", "5Server-RHCertSystem:pki-util-0:8.0.5-1.el5pki.src", "5Server-RHCertSystem:pki-util-javadoc-0:8.0.5-1.el5pki.noarch", ], }, ], threats: [ { category: "impact", details: "Moderate", }, ], title: "System: SCEP one-time PIN reuse", }, ], }
ghsa-5f9q-v927-crw8
Vulnerability from github
Published
2022-05-17 05:45
Modified
2022-05-17 05:45
Details
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.
{ affected: [], aliases: [ "CVE-2010-3869", ], database_specific: { cwe_ids: [], github_reviewed: false, github_reviewed_at: null, nvd_published_at: "2010-11-17T16:00:00Z", severity: "MODERATE", }, details: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", id: "GHSA-5f9q-v927-crw8", modified: "2022-05-17T05:45:54Z", published: "2022-05-17T05:45:54Z", references: [ { type: "ADVISORY", url: "https://nvd.nist.gov/vuln/detail/CVE-2010-3869", }, { type: "WEB", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { type: "WEB", url: "https://fedorahosted.org/pki/changeset/1246", }, { type: "WEB", url: "https://rhn.redhat.com/errata/RHSA-2010-0837.html", }, { type: "WEB", url: "https://rhn.redhat.com/errata/RHSA-2010-0838.html", }, { type: "WEB", url: "http://secunia.com/advisories/42181", }, { type: "WEB", url: "http://securitytracker.com/id?1024697", }, { type: "WEB", url: "http://www.osvdb.org/69148", }, ], schema_version: "1.4.0", severity: [], }
fkie_cve-2010-3869
Vulnerability from fkie_nvd
Published
2010-11-17 16:00
Modified
2025-04-11 00:51
Severity ?
Summary
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| redhat | certificate_system | 7.3 | |
| redhat | certificate_system | 8 | |
| redhat | dogtag_certificate_system | * |
{ configurations: [ { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:redhat:certificate_system:7.3:*:*:*:*:*:*:*", matchCriteriaId: "E2654E6A-190C-4D5C-ABC0-89011DD8E293", vulnerable: true, }, { criteria: "cpe:2.3:a:redhat:certificate_system:8:*:*:*:*:*:*:*", matchCriteriaId: "C2EF75FF-FCDB-433C-A7B9-4DBAABAC6643", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, { nodes: [ { cpeMatch: [ { criteria: "cpe:2.3:a:redhat:dogtag_certificate_system:*:*:*:*:*:*:*:*", matchCriteriaId: "06D606EF-447B-42C5-ADBE-14515257262B", vulnerable: true, }, ], negate: false, operator: "OR", }, ], }, ], cveTags: [], descriptions: [ { lang: "en", value: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", }, { lang: "es", value: "Red Hat Certificate System (RHCS) v7.3 y v8 y Dogtag Certificate System permiten a usuarios autenticados remotamente generar un número aleatorio de certificados mediante la sustitución de un único PIN SCEP one-time.", }, ], id: "CVE-2010-3869", lastModified: "2025-04-11T00:51:21.963", metrics: { cvssMetricV2: [ { acInsufInfo: false, baseSeverity: "MEDIUM", cvssData: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, source: "nvd@nist.gov", type: "Primary", userInteractionRequired: false, }, ], }, published: "2010-11-17T16:00:01.920", references: [ { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/42181", }, { source: "secalert@redhat.com", url: "http://securitytracker.com/id?1024697", }, { source: "secalert@redhat.com", url: "http://www.osvdb.org/69148", }, { source: "secalert@redhat.com", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { source: "secalert@redhat.com", tags: [ "Patch", ], url: "https://fedorahosted.org/pki/changeset/1246", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://rhn.redhat.com/errata/RHSA-2010-0837.html", }, { source: "secalert@redhat.com", tags: [ "Vendor Advisory", ], url: "https://rhn.redhat.com/errata/RHSA-2010-0838.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/42181", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://securitytracker.com/id?1024697", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "http://www.osvdb.org/69148", }, { source: "af854a3a-2127-422b-91ae-364da2661108", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Patch", ], url: "https://fedorahosted.org/pki/changeset/1246", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://rhn.redhat.com/errata/RHSA-2010-0837.html", }, { source: "af854a3a-2127-422b-91ae-364da2661108", tags: [ "Vendor Advisory", ], url: "https://rhn.redhat.com/errata/RHSA-2010-0838.html", }, ], sourceIdentifier: "secalert@redhat.com", vulnStatus: "Deferred", weaknesses: [ { description: [ { lang: "en", value: "CWE-310", }, ], source: "nvd@nist.gov", type: "Primary", }, ], }
gsd-2010-3869
Vulnerability from gsd
Modified
2023-12-13 01:21
Details
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.
Aliases
Aliases
{ GSD: { alias: "CVE-2010-3869", description: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", id: "GSD-2010-3869", references: [ "https://access.redhat.com/errata/RHSA-2010:0838", "https://access.redhat.com/errata/RHSA-2010:0837", ], }, gsd: { metadata: { exploitCode: "unknown", remediation: "unknown", reportConfidence: "confirmed", type: "vulnerability", }, osvSchema: { aliases: [ "CVE-2010-3869", ], details: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", id: "GSD-2010-3869", modified: "2023-12-13T01:21:34.806837Z", schema_version: "1.4.0", }, }, namespaces: { "cve.org": { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2010-3869", STATE: "PUBLIC", }, affects: { vendor: { vendor_data: [ { product: { product_data: [ { product_name: "n/a", version: { version_data: [ { version_affected: "=", version_value: "n/a", }, ], }, }, ], }, vendor_name: "n/a", }, ], }, }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "eng", value: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "eng", value: "n/a", }, ], }, ], }, references: { reference_data: [ { name: "http://secunia.com/advisories/42181", refsource: "MISC", url: "http://secunia.com/advisories/42181", }, { name: "http://securitytracker.com/id?1024697", refsource: "MISC", url: "http://securitytracker.com/id?1024697", }, { name: "https://rhn.redhat.com/errata/RHSA-2010-0837.html", refsource: "MISC", url: "https://rhn.redhat.com/errata/RHSA-2010-0837.html", }, { name: "https://rhn.redhat.com/errata/RHSA-2010-0838.html", refsource: "MISC", url: "https://rhn.redhat.com/errata/RHSA-2010-0838.html", }, { name: "http://www.osvdb.org/69148", refsource: "MISC", url: "http://www.osvdb.org/69148", }, { name: "https://fedorahosted.org/pki/changeset/1246", refsource: "MISC", url: "https://fedorahosted.org/pki/changeset/1246", }, { name: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", refsource: "MISC", url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, ], }, }, "nvd.nist.gov": { configurations: { CVE_data_version: "4.0", nodes: [ { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:redhat:certificate_system:7.3:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, { cpe23Uri: "cpe:2.3:a:redhat:certificate_system:8:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, { children: [], cpe_match: [ { cpe23Uri: "cpe:2.3:a:redhat:dogtag_certificate_system:*:*:*:*:*:*:*:*", cpe_name: [], vulnerable: true, }, ], operator: "OR", }, ], }, cve: { CVE_data_meta: { ASSIGNER: "secalert@redhat.com", ID: "CVE-2010-3869", }, data_format: "MITRE", data_type: "CVE", data_version: "4.0", description: { description_data: [ { lang: "en", value: "Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System allow remote authenticated users to generate an arbitrary number of certificates by replaying a single SCEP one-time PIN.", }, ], }, problemtype: { problemtype_data: [ { description: [ { lang: "en", value: "CWE-310", }, ], }, ], }, references: { reference_data: [ { name: "1024697", refsource: "SECTRACK", tags: [], url: "http://securitytracker.com/id?1024697", }, { name: "https://fedorahosted.org/pki/changeset/1246", refsource: "CONFIRM", tags: [ "Patch", ], url: "https://fedorahosted.org/pki/changeset/1246", }, { name: "42181", refsource: "SECUNIA", tags: [ "Vendor Advisory", ], url: "http://secunia.com/advisories/42181", }, { name: "RHSA-2010:0837", refsource: "REDHAT", tags: [ "Vendor Advisory", ], url: "https://rhn.redhat.com/errata/RHSA-2010-0837.html", }, { name: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", refsource: "CONFIRM", tags: [], url: "https://bugzilla.redhat.com/show_bug.cgi?id=648883", }, { name: "69148", refsource: "OSVDB", tags: [], url: "http://www.osvdb.org/69148", }, { name: "RHSA-2010:0838", refsource: "REDHAT", tags: [ "Vendor Advisory", ], url: "https://rhn.redhat.com/errata/RHSA-2010-0838.html", }, ], }, }, impact: { baseMetricV2: { cvssV2: { accessComplexity: "LOW", accessVector: "NETWORK", authentication: "SINGLE", availabilityImpact: "NONE", baseScore: 4, confidentialityImpact: "NONE", integrityImpact: "PARTIAL", vectorString: "AV:N/AC:L/Au:S/C:N/I:P/A:N", version: "2.0", }, exploitabilityScore: 8, impactScore: 2.9, obtainAllPrivilege: false, obtainOtherPrivilege: false, obtainUserPrivilege: false, severity: "MEDIUM", userInteractionRequired: false, }, }, lastModifiedDate: "2010-11-18T05:00Z", publishedDate: "2010-11-17T16:00Z", }, }, }
Log in or create an account to share your comment.
Security Advisory comment format.
This schema specifies the format of a comment related to a security advisory.
UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).
Loading…
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.