CVE-2023-34196: High severity ejbca vulnerability
Published Aug 3, 2023
·Updated
In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an authentication issue. In configurations using OAuth, disclosure of CA certificates (attributes and public keys) to unauthenticated or less privileged users may occur.
Affected Software
1 affected component
Keyfactor EJBCA<8.0.0
Event History
Aug 3, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
03:15 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2023-34196?
CVE-2023-34196 is identified as a partial denial of service vulnerability due to an authentication issue.
2
How do I fix CVE-2023-34196?
To mitigate CVE-2023-34196, upgrade Keyfactor EJBCA to version 8.0.0 or later.
3
What are the risks associated with CVE-2023-34196?
The main risk of CVE-2023-34196 is the potential disclosure of CA certificates and public keys to unauthorized users.
4
Which versions of Keyfactor EJBCA are affected by CVE-2023-34196?
CVE-2023-34196 affects Keyfactor EJBCA versions prior to 8.0.0.
5
What types of configurations are vulnerable in CVE-2023-34196?
CVE-2023-34196 primarily impacts configurations using OAuth for authentication.