CVE-2008-5082
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows…
Does this matter?
Lower severity and a low EPSS score (0.78%). Track it; it rarely justifies an emergency change on its own.
Description
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.
- CVSS 2.0
- 6.0 MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
- EPSS
- 0.78% probability · 54th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-287
- Affected
- redhat/ dogtag certificate system · redhat/certificate system
- Source
- secalert@redhat.com
References
- http://secunia.com/advisories/33693Vendor Advisory
- http://www.securityfocus.com/bid/33508
- http://www.vupen.com/english/advisories/2009/0145
- https://bugzilla.redhat.com/show_bug.cgi?id=475998
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48331
- https://rhn.redhat.com/errata/RHSA-2009-0007.htmlVendor Advisory
- http://secunia.com/advisories/33693Vendor Advisory
- http://www.securityfocus.com/bid/33508
- http://www.vupen.com/english/advisories/2009/0145
- https://bugzilla.redhat.com/show_bug.cgi?id=475998
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48331
- https://rhn.redhat.com/errata/RHSA-2009-0007.htmlVendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.