It was discovered that Red Hat Certificate System may store plain text passwords in multiple debug log files (such as UserDirEnrollment password or RA wizard installer log).

This problem allows any local user to extract plain text passwords from the Red Hat Certificate System debug log files.

It was discovered that Red Hat Certificate System use insecure default file permissions on configuration files (such as password.conf) that may contain authentication credentials or other sensitive information that should only be accessible to administrative and service users.

This problem allows any local user to read Red Hat Certificate System configuration files.

A temporary denial of service flaw was found in the way token processing system of Certificate System processed user certificate search queries with certain empty search fields. A remote attacker could use this flaw to cause the main Apache httpd web server broker it to need to restart (resulting into situation where the client would obtain connection reset instead of proper error message), leading to (temporary) denial of service (resulting into any users currently in the middle of enrolling tokens to experience a connection drop and their in progress operation to be terminated).

Multiple cross-site scripting (XSS) flaws were found in the way:

1) 'displayCRL' script of Certificate System sanitized content of 'pageStart' and 'pageSize' variables provided in the query string,

2) 'profileProcess' script of Certificate System sanitized content of 'nonce' variable provided in the query string.

A remote attacker could provide a specially-crafted web page that, when visited by an unsuspecting Certificate System user would lead to arbitrary HTML or web script execution in the context of Certificate System user session.

A denial of service flaw was found in the way token processing system of Certificate System processed interrupted token format operations. A local attacker, via suddenly interrupting the token format operation, could use this flaw to cause pki-tps infrastructure to crash with NULL pointer dereference, subsequently leading to relevant Apache httpd web server worker it to need to restart, rendering it to be unavailable for short period of time possibly halting (already) in-progress operations of other users.