REDHAT-BUG-445227
First published: Mon May 05 2008(Updated: )
A flaw was found in a way Red Hat Certificate System handled Extensions in the certificate signing requests (CSR). All requested Extensions were added to issued certificate despite constraints defined in Certificate Authority (CA) profile. For example, CSR could contain Basic Constraints or Key Usage constraint that once copied to issued certificate would result in creation of subordinate CA certificate, even though CA configuration prohibits issuing of subordinate CA certificate, possibly leading to a bypass the intended security policy. Affected versions: Red Hat Certificate System 7.1, 7.2, 7.3 Netscape Certificate Management System 6.x
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat Certificate System | >=7.1<=7.3 | |
| Netscape Certificate Server | >=6.x |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of REDHAT-BUG-445227?
The severity of REDHAT-BUG-445227 is considered high due to improper handling of certificate extension constraints.
How do I fix REDHAT-BUG-445227?
To fix REDHAT-BUG-445227, ensure that your Red Hat Certificate System is updated to the latest version addressing this vulnerability.
What specific software versions are affected by REDHAT-BUG-445227?
REDHAT-BUG-445227 affects Red Hat Certificate System versions between 7.1 and 7.3 and Netscape Certificate Management System version 6.x and above.
What impact does REDHAT-BUG-445227 have on certificate issuance?
REDHAT-BUG-445227 allows all requested extensions in the CSR to be included in the issued certificate, potentially leading to security risks.
Is there a workaround for REDHAT-BUG-445227 while waiting for a patch?
As a temporary workaround for REDHAT-BUG-445227, you can manually review and restrict the requested extensions in CSRs before issuance.
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2008-1676
- agent/severity
- agent/references
- agent/description
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat certificate system
- vendor/netscape
- canonical/netscape certificate server