CVE-2008-1676
Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.07%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate.
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 1.07% probability · 63th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-255
- Affected
- netscape/certificate management system
- Source
- secalert@redhat.com
References
- http://rhn.redhat.com/errata/RHSA-2008-0500.htmlPatch
- http://rhn.redhat.com/errata/RHSA-2008-0577.htmlPatch
- http://secunia.com/advisories/30929
- http://www.securityfocus.com/bid/30062
- http://www.securitytracker.com/id?1020427
- https://bugzilla.redhat.com/show_bug.cgi?id=445227
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43573
- http://rhn.redhat.com/errata/RHSA-2008-0500.htmlPatch
- http://rhn.redhat.com/errata/RHSA-2008-0577.htmlPatch
- http://secunia.com/advisories/30929
- http://www.securityfocus.com/bid/30062
- http://www.securitytracker.com/id?1020427
- https://bugzilla.redhat.com/show_bug.cgi?id=445227
- https://exchange.xforce.ibmcloud.com/vulnerabilities/43573
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.