CVE-2008-2368: Low severity ietf x.509 certificate vulnerability
It was discovered that Red Hat Certificate System may store plain text passwords in multiple debug log files (such as UserDirEnrollment password or RA wizard installer log).
This problem allows any local user to extract plain text passwords from the Red Hat Certificate System debug log files.
Other sources
Red Hat Certificate System 7.2 stores passwords in cleartext in the UserDirEnrollment log, the RA wizard installer log, and unspecified other debug log files, and uses weak permissions for these files, which allows local users to discover passwords by reading the files.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-2368?
CVE-2008-2368 has a high severity due to the potential exposure of plain text passwords stored in debug log files.
How do I fix CVE-2008-2368?
To fix CVE-2008-2368, users should upgrade to a patched version of Red Hat Certificate System that eliminates plain text password logging.
What causes CVE-2008-2368?
CVE-2008-2368 is caused by Red Hat Certificate System storing sensitive passwords in debug logs without proper encryption.
Who is affected by CVE-2008-2368?
Any local user with access to the debug log files of Red Hat Certificate System 7.2 is potentially affected by CVE-2008-2368.
What are the risks associated with CVE-2008-2368?
The risks associated with CVE-2008-2368 include unauthorized access to sensitive information, such as user credentials, by local users.