Maple Labs

CVE search · CVE-2017-2590

CVE-2017-2590

high 8.1

A vulnerability was found in ipa before 4.4. IdM's ca-del, ca-disable, and ca-enable commands did not properly check the user's permissions while modifying CAs in Dogtag. An authenticated, unauthorized attacker could use this flaw to delete, disable, or enable CAs causing various denial of service problems with certificate issuance, OCSP signing, and deletion of secret keys.

Open in the NVD CVE.org JSON

Details

Status
Modified
Published
Last changed
Source
secalert@redhat.com
Weakness
CWE-732, CWE-275

Severity

VersionScoreVectorSource
CVSS 3.0 high 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H secalert@redhat.comSecondary
CVSS 3.0 high 8.1 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H nvd@nist.govPrimary
CVSS 2.0 medium 5.5 AV:N/AC:L/Au:S/C:N/I:P/A:P nvd@nist.govPrimary

Affected products

Vendor and product from the NVD’s CPE applicability statements. Versions and conditions are on the NVD’s page.

  • freeipa · freeipa
  • redhat · enterprise_linux
  • redhat · enterprise_linux_desktop
  • redhat · enterprise_linux_server
  • redhat · enterprise_linux_server_aus
  • redhat · enterprise_linux_server_eus
  • redhat · enterprise_linux_workstation

References