Read the docs
TI-2018-00999 Aliases CVE-2018-1080GHSA-h277-5r6v-m3gv

Improper access control in [UNKNOWN] pki-core

Priority LOW 38CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 8 fixed, 2 without a fix

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-284.

Summary

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Why it matters now

EPSS 0.01516 74th percentileScored 2026-11-07
Fix Partial Red Hat: 1 advisoryRed Hat: 8 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
[UNKNOWN]pki-corePKI 10.6.1—No fix listedCNA
  • pki-core Vendor[UNKNOWN] Affected PKI 10.6.1 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dogtagpki:dogtagpki:*:*:*:*:*:*:*:*up to 10.6.1VulnerableDogtag PKI
  • cpe:2.3:a:dogtagpki:dogtagpki:*:*:*:*:*:*:*:* Versions up to 10.6.1 Vulnerable ·Dogtag PKI

Remediation

Red Hat 1 advisory

  • RHSA-2018:1979 Released 2018-06-26 · Red Hat rating Moderate
    pki-core security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Client Optional (v. 7) pki-base-10.5.1-13.1.el7_5, pki-base-java-10.5.1-13.1.el7_5, pki-ca-10.5.1-13.1.el7_5 +6
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) pki-base-10.5.1-13.1.el7_5, pki-base-java-10.5.1-13.1.el7_5, pki-ca-10.5.1-13.1.el7_5 +6
    • Red Hat Enterprise Linux Server (v. 7) pki-base-10.5.1-13.1.el7_5, pki-base-java-10.5.1-13.1.el7_5, pki-ca-10.5.1-13.1.el7_5 +5
    • Red Hat Enterprise Linux Server Optional (v. 7) pki-base-10.5.1-13.1.el7_5, pki-base-java-10.5.1-13.1.el7_5, pki-ca-10.5.1-13.1.el7_5 +6
    • Red Hat Enterprise Linux Workstation (v. 7) pki-base-10.5.1-13.1.el7_5, pki-base-java-10.5.1-13.1.el7_5, pki-ca-10.5.1-13.1.el7_5 +5
    • Red Hat Enterprise Linux Workstation Optional (v. 7) pki-javadoc-10.5.1-13.1.el7_5
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) pki-base-10.5.1-13.1.el7_5, pki-base-java-10.5.1-13.1.el7_5, pki-ca-10.5.1-13.1.el7_5 +5
    • Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) pki-base-10.5.1-13.1.el7_5, pki-base-java-10.5.1-13.1.el7_5, pki-ca-10.5.1-13.1.el7_5 +6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Certificate System 9AffectedNo fix yet
Red Hat Enterprise Linux 6AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2018:1979
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2018:1979
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2018:1979
Red Hat Enterprise Linux Server Optional (v. 7)Fixed RHSA-2018:1979
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2018:1979
Red Hat Enterprise Linux Workstation Optional (v. 7)Fixed RHSA-2018:1979
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7)Fixed RHSA-2018:1979
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7)Fixed RHSA-2018:1979
Not affected: 1 product
  • Red Hat Enterprise Linux 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-1080
  2. 2026-10-03 Alias added: GHSA-h277-5r6v-m3gv

References

Patch 1

Advisory 3

  • TI-2022-02229 XML external entity injection in Dogtag PKI CVSS 3.1HIGH 7.5
  • TI-2021-03479 Incorrect authorization in pki-core CVSS 3.1HIGH 8.1
  • TI-2017-05178 Hard-coded credentials in Dogtag PKI pki-core CVSS 3.0HIGH 7.5
  • TI-2021-02504 Cleartext storage of sensitive information in pki-server CVSS 3.1HIGH 7.8
  • TI-2020-12392 In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable… CVSS 3.1MEDIUM 6.8
  • TI-2020-15729 Cross-site scripting in pki-core CVSS 3.1MEDIUM 6.1
See all 13 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences