Red Hat Security Advisory

RHSA-2009:0007

rhpki security and bug fix update

Released 2009-01-29 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Certificate System 7.3 for 4AS pkisetup-7.3.0-14.el4, rhpki-ca-7.3.0-17.el4, rhpki-common-7.3.0-40.el4 +7
Red Hat Certificate System 7.3 for 4ES pkisetup-7.3.0-14.el4, rhpki-ca-7.3.0-17.el4, rhpki-common-7.3.0-40.el4 +7

Fixes 3 records

TI-2008-04835 CVE-2008-5082 · GHSA-j872-hj4c-mqf5

The verifyProof function in the Token Processing System (TPS) component in Red Hat…

LOW 28

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use t…

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.00775 Published 2009-01-30 Fixed CWE-287

TI-2008-02272 CVE-2008-2368 · GHSA-hj7g-ch5r-67hc

Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment…

LOW 11

Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local…

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00243 Published 2009-01-20 Fixed CWE-255

TI-2008-02271 CVE-2008-2367 · GHSA-w7wp-vjg7-vw6c

Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and…

LOW 11

Red Hat Certificate System 7.2 uses world-readable permissions for password.conf and unspecified other configuration files, which allows local users to discover passwords by reading these files.

CVSS 2.0LOW 2.1 Local No auth Interaction — EPSS 0.00243 Published 2009-01-20 Fixed CWE-264