CVE-2017-7537: High severity redhat Enterprise Linux Desktop vulnerability
It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.
Other sources
New CMC feature allows non-agent to submit request for automatic approval, one of them being "SharedToken" currently implemented only as hard-coded string. Anyone who knows about this hard-coded string could get themselves a certificate issued.
Product bug:
https://bugzilla.redhat.com/showbug.cgi?id=1466486
Upstream patch:
https://github.com/dogtagpki/pki/commit/876d13c6d20e7e1235b9
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7537?
The severity of CVE-2017-7537 is critical due to the potential for attackers to bypass authentication and issue fraudulent certificates.
How do I fix CVE-2017-7537?
To fix CVE-2017-7537, upgrade to versions 10.10.2-3 or 11.2.1-2 of the dogtag-pki package, or ensure you are beyond version 10.6.4.
Who is affected by CVE-2017-7537?
CVE-2017-7537 affects users of the dogtag-pki package prior to version 10.6.4 across Red Hat Enterprise Linux platforms.
What software is vulnerable to CVE-2017-7537?
The vulnerable software includes dogtag-pki versions below 10.6.4, as well as several Red Hat Enterprise Linux distributions on specific versions.
What is the exploit method for CVE-2017-7537?
The exploit method for CVE-2017-7537 involves an attacker utilizing a hardcoded secret to bypass the regular authentication of the CA server.