Bug 1470817 (CVE-2017-7537)

Summary: CVE-2017-7537 pki-core: mock CMC authentication plugin with hardcoded secret enabled by default
Product: [Other] Security Response Reporter: Adam Mariš <amaris>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aakkiang, alee, cfu, dkholia, dsirrine, edewata, enewland, kwright, mharmsen, rhcs-maint, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2017-08-02 08:29:35 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1469432, 1470947, 1470948    
Bug Blocks: 1470819    
Attachments:
Description Flags
patch to disable SharedSecret plugin none

Description Adam Mariš 2017-07-13 18:09:28 UTC 
New CMC feature allows non-agent to submit request for automatic approval, one of them being "SharedToken" currently implemented only as hard-coded string. Anyone who knows about this hard-coded string could get themselves a certificate issued.

Product bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1466486

Upstream patch:

https://github.com/dogtagpki/pki/commit/876d13c6d20e7e1235b9
Comment 4 Dhiru Kholia 2017-07-14 09:00:57 UTC 
Created attachment 1298215 [details]
patch to disable SharedSecret plugin
Comment 5 Dhiru Kholia 2017-07-19 09:47:32 UTC 
Acknowledgments:

Name: Christina Fu (Red Hat)
Comment 6 errata-xmlrpc 2017-08-01 11:31:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2335 https://access.redhat.com/errata/RHSA-2017:2335