CVE Vulnerabilities

CVE-2020-15720

Improper Certificate Validation

Published: Jul 14, 2020 | Modified: Jul 23, 2020
CVSS 3.x
6.8
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 2.x
4 MEDIUM
AV:N/AC:H/Au:N/C:P/I:P/A:N
RedHat/V2
RedHat/V3
6.8 MODERATE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Ubuntu

In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.

Weakness

The software does not validate, or incorrectly validates, a certificate.

Affected Software

Name Vendor Start Version End Version
Dogtagpki Dogtagpki * 10.8.3
Red Hat Enterprise Linux 8 RedHat pki-core:10.6-8030020200911215836.5ff1562f *
Red Hat Enterprise Linux 8 RedHat pki-deps:10.6-8030020200527165326.30b713e6 *
Dogtag-pki Ubuntu bionic *
Dogtag-pki Ubuntu eoan *
Dogtag-pki Ubuntu trusty *
Dogtag-pki Ubuntu upstream *
Dogtag-pki Ubuntu xenial *

Potential Mitigations

References