VulnerabilityModified
CVE-2020-15720
Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting.
MEDIUM 6.8EPSS 1.01%
Does this matter?
Lower severity and a low EPSS score (1.01%). Track it; it rarely justifies an emergency change on its own.
Description
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
- CVSS 3.1
- 6.8 MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
- EPSS
- 1.01% probability · 61th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-295
- Affected
- dogtagpki/dogtagpki
- Source
- cve@mitre.org
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1855273Issue Tracking, Patch, Third Party Advisory
- https://github.com/dogtagpki/pki/commit/50c23ec146ee9abf28c9de87a5f7787d495f0b72Patch, Third Party Advisory
- https://github.com/dogtagpki/pki/compare/v10.9.0-a2...v10.9.0-b1Patch, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1855273Issue Tracking, Patch, Third Party Advisory
- https://github.com/dogtagpki/pki/commit/50c23ec146ee9abf28c9de87a5f7787d495f0b72Patch, Third Party Advisory
- https://github.com/dogtagpki/pki/compare/v10.9.0-a2...v10.9.0-b1Patch, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.