CVE-2017-7537 – pki-core: mock CMC authentication plugin with hardcoded secret enabled by default

https://notcve.org/view.php?id=CVE-2017-7537

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates. Se ha detectado que un plugin de autenticación CMC simulado con un secreto embebido se ha habilitado por accidente y por defecto en el paquete pki-core en versiones anteriores a la 10.6.4. Un atacante podría utilizar este fallo para omitir el proceso de autenticación regular y engañar al servidor CA para que envíe certificados. It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package. • https://access.redhat.com/errata/RHSA-2017:2335 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7537 https://github.com/dogtagpki/pki/commit/876d13c6d20e7e1235b9 https://access.redhat.com/security/cve/CVE-2017-7537 https://bugzilla.redhat.com/show_bug.cgi?id=1470817 • CWE-287: Improper Authentication CWE-592: DEPRECATED: Authentication Bypass Issues CWE-798: Use of Hard-coded Credentials •