CVE-2022-2393: High severity pki-core project vulnerability
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content.
Other sources
When using the caServerKeygenDirUserCert profile with UserDirEnrollment auth type, usre are able to get a certificate for any UID I please simply by entering their name in the Subject information fields. This occurs only when Directory-based authentication is enabled, which is disabled by default.
— Red Hat
Affected Software
Remediation
Information
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-2393?
CVE-2022-2393 is a vulnerability in pki-core that allows a user to get a certificate for another user identity.
How does CVE-2022-2393 affect pki-core?
CVE-2022-2393 affects pki-core when directory-based authentication is enabled.
What is the severity of CVE-2022-2393?
The severity of CVE-2022-2393 is high with a CVSS score of 7.6.
How can an attacker exploit CVE-2022-2393?
An authenticated attacker on the adjacent network can impersonate another user within the scope of the domain.
What is the remedy for CVE-2022-2393?
Update pki-core to version 0:10.5.18-23.el7, 0:10.5.18-23.el7_9, or 0:11.3.0-1.el9 to address the vulnerability.