CVE-2012-4556: Input Validation
A temporary denial of service flaw was found in the way token processing system of Certificate System processed user certificate search queries with certain empty search fields. A remote attacker could use this flaw to cause the main Apache httpd web server broker it to need to restart (resulting into situation where the client would obtain connection reset instead of proper error message), leading to (temporary) denial of service (resulting into any users currently in the middle of enrolling tokens to experience a connection drop and their in progress operation to be terminated).
Other sources
The token processing system (pki-tps) in Red Hat Certificate System (RHCS) before 8.1.3 allows remote attackers to cause a denial of service (Apache httpd web server child process restart) via certain unspecified empty search fields in a user certificate search query.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2012-4556?
CVE-2012-4556 has been classified with a moderate severity level due to its potential to cause a temporary denial of service.
How do I fix CVE-2012-4556?
To fix CVE-2012-4556, it is recommended to update the affected Red Hat Certificate System to a version that is not vulnerable.
What versions of Red Hat Certificate System are affected by CVE-2012-4556?
CVE-2012-4556 affects Red Hat Certificate System versions 7.1, 7.2, 7.3, and 8.1.1, as well as versions 8.0 and 8.1.
Can CVE-2012-4556 be exploited remotely?
Yes, an attacker can exploit CVE-2012-4556 remotely by using specific empty search fields in user certificate queries.
What are the consequences of exploiting CVE-2012-4556?
Exploiting CVE-2012-4556 can result in a temporary denial of service that forces the main Apache HTTP server to restart.