CVE-2024-36066: Low severity ejbca vulnerability
The CMP CLI client in KeyFactor EJBCA before 8.3.1 has only 6 octets of salt, and is thus not compliant with the security requirements of RFC 4211, and might make man-in-the-middle attacks easier. CMP includes password-based MAC as one of the options for message integrity and authentication (the other option is certificate-based). RFC 4211 section 4.4 requires that password-based MAC parameters use a salt with a random value of at least 8 octets. This helps to inhibit dictionary attacks. Because the standalone CMP client originally was developed as test code, the salt was instead hardcoded and only 6 octets long.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-36066?
CVE-2024-36066 has been assessed as a high severity vulnerability due to its potential to facilitate man-in-the-middle attacks.
How do I fix CVE-2024-36066?
To mitigate CVE-2024-36066, update KeyFactor EJBCA to version 8.3.1 or later.
What are the risks associated with CVE-2024-36066?
The primary risk of CVE-2024-36066 is that it could allow attackers to compromise message integrity and authentication during CMP transactions.
Which versions of KeyFactor EJBCA are affected by CVE-2024-36066?
CVE-2024-36066 affects all versions of KeyFactor EJBCA prior to 8.3.1.
Is there a workaround for CVE-2024-36066?
There are no known effective workarounds for CVE-2024-36066 aside from upgrading to the recommended version.