CVE-2020-15720: Medium severity dogtag certificate system vulnerability
A flaw was found in PKI, where the dogtag's pki.client.PKIConnection class disables the python-requests certificate validation. This flaw allows an attacker to intercept a connection between a FreeIPA client and a server, and execute an active Man-in-the-Middle attack. The highest threat from this vulnerability is to confidentiality and integrity.
Other sources
Dogtag's pki.client.PKIConnection class disables python-requests certificate validation. The argument verify=False means that no certificate validation is performed at all [2]. The client accepts any certificate. Since the verify parameter is hard-coded in all request functions, it is not possible to override the setting.
PKIConnection should use requests default settings (verify with default certs) and offer an API to override default CA certs or disable requests.
[2] https://requests.readthedocs.io/en/master/user/advanced/#ssl-cert-verification
— Red Hat
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-15720?
CVE-2020-15720 is a vulnerability found in Dogtag PKI.
What is the severity of CVE-2020-15720?
CVE-2020-15720 has a severity score of 6.8 (medium).
How does CVE-2020-15720 affect Dogtag PKI?
CVE-2020-15720 affects Dogtag PKI versions up to 10.8.3.
How can I fix CVE-2020-15720?
To fix CVE-2020-15720, update Dogtag PKI to version 10.9.0 or later.
Where can I find more information about CVE-2020-15720?
You can find more information about CVE-2020-15720 at the following references: 1. [CVE-2020-15720 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2020-15720) 2. [CVE-2020-15720 on NIST NVD](https://nvd.nist.gov/vuln/detail/CVE-2020-15720) 3. [Bugzilla Bug Report](https://bugzilla.redhat.com/show_bug.cgi?id=1855273) 4. [Red Hat Security Advisory](https://access.redhat.com/errata/RHSA-2020:4847)