Red Hat Bugzilla – Bug 304571
CVE-2007-4994 rhcs CRL can get corrupted
Last modified: 2008-01-14 11:19:19 EST
New revocations performed while a CRL is being generated
could potentially cause revoked certificates at the upper
end of the serial number range to not appear on the CRL.
In subsequent CRLs, those missing certificates could again
appear on the CRL.
CVSS base score 3.6:
AccessComplexity: High (you have no way of making a particular certificate
become unrevoked, just chance)
Authentication: Single (you need an otherwise valid but revoked certificate)
This issue was addressed in:
Red Hat Certificate System: