PT-2018-7120 · Idm+3 · Ipa+3

Published 2017-03-02 · Updated 2019-10-09 · CVE-2017-2590

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions: ipa versions prior to 4.4

Description: A flaw was discovered in the way IdM's ca-del, ca-disable, and ca-enable commands handle user permissions when modifying CAs in Dogtag. This issue allows an authenticated, unauthorized attacker to delete, disable, or enable CAs, potentially causing denial of service problems related to certificate issuance, OCSP signing, and deletion of secret keys.

Recommendations: For versions prior to 4.4, update to version 4.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the ca-del, ca-disable, and ca-enable commands to authorized users only until a patch is available.

Fix

DoS

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-275

Related Identifiers

ALT-PU-2017-2403

CESA-2017_0388

CVE-2017-2590

RHSA-2017:0388

RHSA-2017_0388

Affected Products

Alt Linux

Centos

Red Hat

Ipa

References · 21

• https://osv.dev/vulnerability/UBUNTU-CVE-2017-2590 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-2590 · Security Note
• https://linux.oracle.com/errata/ELSA-2017-0388.html · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2590 · Patch
• http://rhn.redhat.com/errata/RHSA-2017-0388.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2017-2403 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-2590 · Security Note
• https://ubuntu.com/security/CVE-2017-2590 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-2590 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-2590 · Security Note
• https://lists.centos.org/pipermail/centos-announce/2017-March/071785.html · Note
• https://access.redhat.com/security/cve/CVE-2017-2590 · Note
• http://securityfocus.com/bid/96557 · Note
• https://lists.centos.org/pipermail/centos-announce/2017-March/022310.html · Note
• https://lists.centos.org/pipermail/centos-announce/2017-March/084472.html · Note