CVE-2022-34831: Critical severity ejbca vulnerability
An issue was discovered in Keyfactor PrimeKey EJBCA before 7.9.0, related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one or multiple dnsNames. These are validated properly in the ACME challenge. However, if the validation passes, a non-compliant client can include additional dnsNames the CSR sent to the finalize endpoint, resulting in EJBCA issuing a certificate including the identifiers that were not validated. This occurs even if the certificate profile is configured to not allow a DN override by the CSR.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-34831?
CVE-2022-34831 has been classified as a medium severity vulnerability.
How do I fix CVE-2022-34831?
To address CVE-2022-34831, upgrade to Keyfactor PrimeKey EJBCA version 7.9.0 or later.
What types of inconsistencies are involved in CVE-2022-34831?
CVE-2022-34831 involves inconsistencies between DNS identifiers in an ACME order and the corresponding Certificate Signing Request.
What is affected in Keyfactor EJBCA due to CVE-2022-34831?
CVE-2022-34831 affects the ACME enrollment process in Keyfactor EJBCA versions before 7.9.0.
Who should be concerned about CVE-2022-34831?
Organizations using Keyfactor PrimeKey EJBCA versions prior to 7.9.0 should be concerned about CVE-2022-34831.