CVE-2018-1080: High severity dogtag certificate system vulnerability
Dogtag PKI through version 10.5.1 has a vulnerability in AAclAuthz.java that, under certain configuration, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access.
Other sources
Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2018-1080.
What is the severity of CVE-2018-1080?
The severity of CVE-2018-1080 is high with a severity value of 8.1.
How does the vulnerability in AAclAuthz.java affect Dogtag PKI?
The vulnerability in AAclAuthz.java, under certain configurations, causes the application of ACL allow and deny rules to be reversed in Dogtag PKI.
How can I fix the CVE-2018-1080 vulnerability in Dogtag PKI?
To fix the CVE-2018-1080 vulnerability in Dogtag PKI, update to version 10.6.1 or later.
Where can I find more information about CVE-2018-1080?
You can find more information about CVE-2018-1080 on Red Hat's website at: https://access.redhat.com/errata/RHSA-2018:1979.