REDHAT-BUG-445227: High severity red hat certificate system vulnerability
A flaw was found in a way Red Hat Certificate System handled Extensions in the certificate signing requests (CSR). All requested Extensions were added to issued certificate despite constraints defined in Certificate Authority (CA) profile.
For example, CSR could contain Basic Constraints or Key Usage constraint that once copied to issued certificate would result in creation of subordinate CA certificate, even though CA configuration prohibits issuing of subordinate CA certificate, possibly leading to a bypass the intended security policy.
Affected versions: Red Hat Certificate System 7.1, 7.2, 7.3 Netscape Certificate Management System 6.x
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-445227?
The severity of REDHAT-BUG-445227 is considered high due to improper handling of certificate extension constraints.
How do I fix REDHAT-BUG-445227?
To fix REDHAT-BUG-445227, ensure that your Red Hat Certificate System is updated to the latest version addressing this vulnerability.
What specific software versions are affected by REDHAT-BUG-445227?
REDHAT-BUG-445227 affects Red Hat Certificate System versions between 7.1 and 7.3 and Netscape Certificate Management System version 6.x and above.
What impact does REDHAT-BUG-445227 have on certificate issuance?
REDHAT-BUG-445227 allows all requested extensions in the CSR to be included in the issued certificate, potentially leading to security risks.
Is there a workaround for REDHAT-BUG-445227 while waiting for a patch?
As a temporary workaround for REDHAT-BUG-445227, you can manually review and restrict the requested extensions in CSRs before issuance.