A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.
An input validation error was found in Red Hat Certificate System's handling of client provided certificates before 8.1.20-1. If the certreq field is not present in a certificate an assertion error is triggered causing a denial of service.
A temporary denial of service flaw was found in the way token processing system of Certificate System processed user certificate search queries with certain empty search fields. A remote attacker could use this flaw to cause the main Apache httpd web server broker it to need to restart (resulting into situation where the client would obtain connection reset instead of proper error message), leading to (temporary) denial of service (resulting into any users currently in the middle of enrolling tokens to experience a connection drop and their in progress operation to be terminated).
A denial of service flaw was found in the way token processing system of Certificate System processed interrupted token format operations. A local attacker, via suddenly interrupting the token format operation, could use this flaw to cause pki-tps infrastructure to crash with NULL pointer dereference, subsequently leading to relevant Apache httpd web server worker it to need to restart, rendering it to be unavailable for short period of time possibly halting (already) in-progress operations of other users.
Multiple cross-site scripting (XSS) flaws were found in the way:
1) 'displayCRL' script of Certificate System sanitized content of 'pageStart' and 'pageSize' variables provided in the query string,
2) 'profileProcess' script of Certificate System sanitized content of 'nonce' variable provided in the query string.
A remote attacker could provide a specially-crafted web page that, when visited by an unsuspecting Certificate System user would lead to arbitrary HTML or web script execution in the context of Certificate System user session.
Common Vulnerabilities and Exposures assigned an identifier CVE-2004-2761 to the following vulnerability:
The MD5 Message-Digest Algorithm is not collision resistant, which makes it easier for context-dependent attackers to conduct spoofing attacks, as demonstrated by attacks on the use of MD5 in the signature algorithm of an X.509 certificate.
References: http://www.kb.cert.org/vuls/id/836068 http://eprint.iacr.org/2004/199 http://eprint.iacr.org/2005/067 http://www.win.tue.nl/hashclash/rogue-ca/ http://www.phreedom.org/research/rogue-ca/ http://blog.mozilla.com/security/2008/12/30/md5-weaknesses-could-lead-to-certificate-forgery/
It was discovered that Red Hat Certificate System may store plain text passwords in multiple debug log files (such as UserDirEnrollment password or RA wizard installer log).
This problem allows any local user to extract plain text passwords from the Red Hat Certificate System debug log files.
It was discovered that Red Hat Certificate System use insecure default file permissions on configuration files (such as password.conf) that may contain authentication credentials or other sensitive information that should only be accessible to administrative and service users.
This problem allows any local user to read Red Hat Certificate System configuration files.