Bug 1470817 (CVE-2017-7537) - CVE-2017-7537 pki-core: mock CMC authentication plugin with hardcoded secret enabled by default
Summary: CVE-2017-7537 pki-core: mock CMC authentication plugin with hardcoded secret ...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2017-7537
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1469432 1470947 1470948
Blocks: 1470819
TreeView+ depends on / blocked
 
Reported: 2017-07-13 18:09 UTC by Adam Mariš
Modified: 2021-02-17 01:56 UTC (History)
11 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.
Clone Of:
Environment:
Last Closed: 2017-08-02 08:29:35 UTC
Embargoed:

Attachments (Terms of Use)
patch to disable SharedSecret plugin (1.16 KB, patch)
2017-07-14 09:00 UTC, Dhiru Kholia 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2017:2335 0 normal SHIPPED_LIVE Moderate: pki-core security update 2017-08-01 15:27:31 UTC

Description Adam Mariš 2017-07-13 18:09:28 UTC 
New CMC feature allows non-agent to submit request for automatic approval, one of them being "SharedToken" currently implemented only as hard-coded string. Anyone who knows about this hard-coded string could get themselves a certificate issued.

Product bug:

https://bugzilla.redhat.com/show_bug.cgi?id=1466486

Upstream patch:

https://github.com/dogtagpki/pki/commit/876d13c6d20e7e1235b9
Comment 4 Dhiru Kholia 2017-07-14 09:00:57 UTC 
Created attachment 1298215 [details]
patch to disable SharedSecret plugin
Comment 5 Dhiru Kholia 2017-07-19 09:47:32 UTC 
Acknowledgments:

Name: Christina Fu (Red Hat)
Comment 6 errata-xmlrpc 2017-08-01 11:31:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2017:2335 https://access.redhat.com/errata/RHSA-2017:2335
Note You need to log in before you can comment on or make changes to this bug.