Bug 1413137 – CVE-2017-2590 ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1413137 - (CVE-2017-2590) CVE-2017-2590 ipa: Insufficient permission check for ca-del, ca-disable and ca-enable commands

Summary:	CVE-2017-2590 ipa: Insufficient permission check for ca-del, ca-disable and c...

Status:	CLOSED ERRATA

Aliases:	CVE-2017-2590

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20170227,repor...
Keywords:	Security

Depends On:	1414653 1414703 1427094
Blocks:	1413140
	Show dependency tree / graph

Reported:	2017-01-13 12:37 EST by Andrej Nemec
Modified:	2018-07-27 06:50 EDT (History)
CC List:	8 users (show)

See Also:
Fixed In Version:	ipa 4.4
Doc Type:	If docs needed, set a value
Doc Text:	It was found that IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2017-03-09 13:47:11 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2017:0388	normal	SHIPPED_LIVE	Moderate: ipa security and bug fix update	2017-03-02 17:06:32 EST

Groups: None (edit)

Description Andrej Nemec 2017-01-13 12:37:22 EST

Multiple security issues were found in FreeIPA's 'ca' plugin. Any authenticated but unauthorised user can delete, disable or enable CAs in Dogtag. The impact in the deletion case is denial of service for cert issuance or OCSP signing, and deletion of secret keys. The impact for disablement is denial of service for cert issuance.

Comment 1 Andrej Nemec 2017-01-13 12:37:28 EST

Acknowledgments:

Name: Fraser Tweedale (Red Hat)

Comment 15 Dhiru Kholia 2017-02-27 06:02:28 EST

Created freeipa tracking bugs for this issue:

Affects: fedora-all [bug 1427094]

Comment 16 Jan Cholasta 2017-03-01 06:13:31 EST

Fixed upstream:
master:
https://pagure.io/freeipa/c/b81ac59640f0b76fa9f53cf8be441f085a7089c4?branch=master
ipa-4-4:
https://pagure.io/freeipa/c/1aa314c79648c442473f19344387bfe11ec2141b?branch=ipa-4-4

Comment 18 errata-xmlrpc 2017-03-02 12:25:53 EST

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:0388 https://rhn.redhat.com/errata/RHSA-2017-0388.html

Note You need to log in before you can comment on or make changes to this bug.