REDHAT-BUG-836268: Medium severity Red Hat Certificate System vulnerability
It was discovered that the Red Hat Certificate System's / Dogtag Certificate System's Certificate Manager did not properly check certificate revocation requests. An agent permitted to perform revocations of end entity certificates via Certificate System's web interface could use this flaw to revoke the Certificate Authority (CA) certificate.
The issue was originally reported via bug #832212.
Patch applied to address this issue: https://fedorahosted.org/pki/changeset/2430
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-836268?
The severity of REDHAT-BUG-836268 is considered critical due to the potential for unauthorized certificate revocations.
How do I fix REDHAT-BUG-836268?
To fix REDHAT-BUG-836268, update the Red Hat Certificate System to the latest version available that addresses this vulnerability.
What are the risks associated with REDHAT-BUG-836268?
The risks associated with REDHAT-BUG-836268 include possible denial of service and unauthorized impacts on the trustworthiness of certificates.
Who is affected by REDHAT-BUG-836268?
Organizations using the Red Hat Certificate System or Dogtag Certificate System are affected by REDHAT-BUG-836268.
What type of vulnerability does REDHAT-BUG-836268 represent?
REDHAT-BUG-836268 represents a security vulnerability in the certificate revocation process within the certificate management system.