PT-2020-17067 · Primekey · Primekey Ejbca

Published 2020-11-19 · Updated 2024-03-06 · CVE-2020-28942

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions PrimeKey EJBCA versions prior to 7.4.3

Description An issue exists when enrolling with EST while proxied through an RA over the Peers protocol, allowing enrollment with a valid client certificate through any functioning and authenticated RA connected to the CA, bypassing the restriction of client certificates to a limited set of allowed CAs. This affects the domain security model, where the peer connector's restrictions do not apply as intended for EST implementations, unlike other protocols such as CMP. An attacker must already have a trusted client certificate and authorization to enroll against the targeted CA.

Recommendations For PrimeKey EJBCA versions prior to 7.4.3, update to version 7.4.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the EST implementation until the update can be applied. Additionally, review and reinforce the authorization and authentication processes for RAs connected to the CA to minimize the risk of exploitation.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

BIT-EJBCA-2020-28942

CVE-2020-28942

Affected Products

Primekey Ejbca

References · 5

• https://osv.dev/vulnerability/CVE-2020-28942 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-ejbca-2020-28942 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-28942 · Security Note
• https://support.primekey.com/news/posts/40 · Vendor Advisory
• https://t.me/cibsecurity/16601 · Telegram Post