CVSS: 5.8EPSS: 0%CPEs: 3EXPL: 0CVE-2010-3868 – System: unauthenticated user can request SCEP one-time PIN decryption
https://notcve.org/view.php?id=CVE-2010-3868
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component. Red Hat Certificate System (RHCS) v7.3 y v8 y Dogtag Certificate System no requieren autenticación en peticiones para descifrar PINs SCEP one-time, lo que permite a atacantes remotos la obtención de PINs rastreando el tráfico de red para peticiones SCEP y a continuación enviando peticiones de descifrado al componente Certificate Authority. • http://secunia.com/advisories/42181 http://securitytracker.com/id?1024697 http://www.osvdb.org/69149 https://bugzilla.redhat.com/show_bug.cgi?id=648882 https://fedorahosted.org/pki/changeset/1261 https://rhn.redhat.com/errata/RHSA-2010-0837.html https://rhn.redhat.com/errata/RHSA-2010-0838.html https://access.redhat.com/security/cve/CVE-2010-3868 • CWE-287: Improper Authentication •
CVSS: 6.5EPSS: 0%CPEs: 2EXPL: 0CVE-2009-0588 – rhpki-ra: improper authorization checks in Cerificate System's Registration Authority
https://notcve.org/view.php?id=CVE-2009-0588
agent/request/op.cgi in the Registration Authority (RA) component in Red Hat Certificate System (RHCS) 7.3 and Dogtag Certificate System allows remote authenticated users to approve certificate requests queued for arbitrary agent groups via a modified request ID field. agent/request/op.cgi en el componente Registration Authority (RA) en Red Hat Certificate System (RHCS) 7.3 y Dogtag Certificate System permiten a atacantes remotos autenticados aprobar peticiones de certificado en cola para grupos de agentes de su elección mediante una petición de campo ID modificada. • http://secunia.com/advisories/35242 http://secunia.com/advisories/35263 http://www.redhat.com/support/errata/RHSA-2009-1065.html http://www.securityfocus.com/bid/35104 http://www.securitytracker.com/id?1022278 https://bugzilla.redhat.com/show_bug.cgi?id=484828 https://bugzilla.redhat.com/show_bug.cgi?id=488706 https://access.redhat.com/security/cve/CVE-2009-0588 •
CVSS: 6.0EPSS: 0%CPEs: 4EXPL: 0CVE-2008-5082 – System: missing public key challenge proof verification in the TPS component
https://notcve.org/view.php?id=CVE-2008-5082
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key. La función verifyProof en el componente Token Processing System (TPS) en Red Hat Certificate System (RHCS) v7.1 hasta v7.3 y Dogtag Certificate System v1.0 devuelve con éxito incluso cuando el token implicado no utiliza la clave hardware, lo cual permite a usuarios remotos autenticados con privilegios implicados evitar políticas de autenticación intencionadas implicándose con una clave software. • http://secunia.com/advisories/33693 http://www.securityfocus.com/bid/33508 http://www.vupen.com/english/advisories/2009/0145 https://bugzilla.redhat.com/show_bug.cgi?id=475998 https://exchange.xforce.ibmcloud.com/vulnerabilities/48331 https://rhn.redhat.com/errata/RHSA-2009-0007.html https://access.redhat.com/security/cve/CVE-2008-5082 • CWE-287: Improper Authentication •