Published: 03/07/2018 Updated: 09/10/2019

CVSS v2 Base Score: 6.8 | Impact Score: 6.4 | Exploitability Score: 8.6

CVSS v3 Base Score: 8.1 | Impact Score: 5.9 | Exploitability Score: 2.2

VMScore: 605

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Vulnerable Product	Search on Vulmon	Subscribe to Product
dogtagpki dogtagpki

Synopsis Moderate: pki-core security, bug fix, and enhancement update Type/Severity Security Advisory: Moderate Topic An update for pki-core is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring ...

Debian Bug report logs - #893690 dogtag-pki: CVE-2018-1080: Mishandled ACL configuration in AAclAuthzjava reverses rules that allow and deny access Package: src:dogtag-pki; Maintainer for src:dogtag-pki is Debian FreeIPA Team <pkg-freeipa-devel@alioth-listsdebiannet>; Reported by: Salvatore Bonaccorso <carnil@debianorg ...

Dogtag PKI, through version 1061, has a vulnerability in AAclAuthzjava that, under certain configurations, causes the application of ACL allow and deny rules to be reversed If a server is configured to process allow rules before deny rules (authzevaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access This ...

NVD-CWE-noinfo https://review.gerrithub.io/c/dogtagpki/pki/+/404435 https://pagure.io/freeipa/issue/7453 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1080 https://access.redhat.com/errata/RHSA-2018:1979 https://access.redhat.com/errata/RHSA-2018:1979 https://nvd.nist.gov

CVE-2018-1080

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect