CVE-2017-7562: Medium severity redhat Enterprise Linux vulnerability
A flaw was found in krb5 certificate EKU validation which could lead to improper authorization if a forged certificate with the right EKU and no SAN is used.
The PKINIT certauth eku module should never authoritatively authorize a certificate, because an extended key usage does not establish a relationship between the certificate and any specific user; it only establishes that the certificate was created for PKINIT client authentication.
Upstream bug:
https://github.com/krb5/krb5/pull/694
Upstream patch:
https://github.com/krb5/krb5/pull/694/commits/50fe4074f188c2d4da0c421e96553acea8378db2 https://github.com/krb5/krb5/pull/694/commits/1de6ca2f2eb1fdbab51f1549a25a6903aefcc196 https://github.com/krb5/krb5/pull/694/commits/b7af544e50a4d8291524f590e20dd44430bf627d
Other sources
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2017-7562?
The severity of CVE-2017-7562 is classified as medium due to potential improper authorization issues.
How do I fix CVE-2017-7562?
To fix CVE-2017-7562, ensure you update to the latest version of krb5 that addresses this vulnerability.
What systems are affected by CVE-2017-7562?
CVE-2017-7562 primarily affects Red Hat Enterprise Linux 7.0 and MIT Kerberos 5 versions prior to 1.16.1.
What is the impact of CVE-2017-7562?
The impact of CVE-2017-7562 could lead to unauthorized access if a malicious user utilizes a forged certificate.
Is there a workaround for CVE-2017-7562?
Currently, no specific workarounds for CVE-2017-7562 are recommended other than applying security updates.