CVE-2015-5284: Infoleak
ipa-kra-install in FreeIPA before 4.2.2 puts the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.
Other sources
It was discovered that ipa-kra-install puts the CA agent certificate and private key to a world readable file, /etc/httpd/alias/kra-agent.pem. This allows users on an IPA server where ipa-kra-install was run to issue arbitrary certificates with the IPA CA.
The ipa-kra-install script configures the KRA subsystem of Dogtag, which is used for the Password Vault feature of IPA. During the configuration process, a KRA agent user account is created in Dogtag, which is used by IPA to authenticate to the KRA. Currently the KRA agent uses the same certificate and private key as the CA agent, which IPA uses to authenticate to the CA.
The kra-agent.pem file is necessary because the Dogtag client Python library does not support using a certificate and private key from a NSS database for authentication, so it is not possible to use the CA agent certificate and private key directly from their primary location, which is the NSS database at /etc/httpd/alias.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5284?
CVE-2015-5284 is considered a critical vulnerability due to exposure of sensitive certificate and private key information.
How do I fix CVE-2015-5284?
To fix CVE-2015-5284, upgrade FreeIPA to version 4.2.2 or later.
What files are affected by CVE-2015-5284?
The vulnerable file associated with CVE-2015-5284 is /etc/httpd/alias/kra-agent.pem.
What are the potential risks of CVE-2015-5284?
CVE-2015-5284 can lead to unauthorized access to the CA agent certificate and private key, compromising the security of the FreeIPA installation.
Which versions of FreeIPA are vulnerable to CVE-2015-5284?
Versions of FreeIPA prior to 4.2.2, including 4.2.1 and earlier, are vulnerable to CVE-2015-5284.