CVE-2018-1080
First published: Thu Mar 15 2018(Updated: )
Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/PKI | <10.6.1 | 10.6.1 |
| Dogtagpki Dogtagpki | <=10.6.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2018:1979
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1080
- https://pagure.io/freeipa/issue/7453
- https://review.gerrithub.io/c/dogtagpki/pki/+/404435
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1556658
- https://review.gerrithub.io/#/c/404435/
- https://access.redhat.com/security/updates/classification/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1558108
- https://bugzilla.redhat.com/show_bug.cgi?id=1556657
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-1080.
What is the severity of CVE-2018-1080?
The severity of CVE-2018-1080 is high with a severity value of 8.1.
How does the vulnerability in AAclAuthz.java affect Dogtag PKI?
The vulnerability in AAclAuthz.java, under certain configurations, causes the application of ACL allow and deny rules to be reversed in Dogtag PKI.
How can I fix the CVE-2018-1080 vulnerability in Dogtag PKI?
To fix the CVE-2018-1080 vulnerability in Dogtag PKI, update to version 10.6.1 or later.
Where can I find more information about CVE-2018-1080?
You can find more information about CVE-2018-1080 on Red Hat's website at: https://access.redhat.com/errata/RHSA-2018:1979.
- collector/nvd-index
- agent/type
- agent/last-modified-date
- agent/softwarecombine
- agent/first-publish-date
- agent/remedy
- agent/severity
- agent/references
- agent/weakness
- agent/author
- agent/description
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2018-1080
- agent/software-canonical-lookup
- agent/tags
- agent/event
- collector/mitre-cve
- source/MITRE
- vendor/dogtagpki
- canonical/dogtagpki dogtagpki
- version/dogtagpki dogtagpki/10.6.1
- package-manager/redhat