PT-2022-22383 · Keyfactor · Keyfactor Primekey Ejbca
Published
2022-09-14
·
Updated
2024-03-06
·
CVE-2022-34831
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Keyfactor PrimeKey EJBCA versions prior to 7.9.0
Description
An issue was discovered related to possible inconsistencies in DNS identifiers submitted in an ACME order and the corresponding CSR submitted during finalization. During the ACME enrollment process, an order is submitted containing an identifier for one or multiple dnsNames. These are validated properly in the ACME challenge. However, if the validation passes, a non-compliant client can include additional dnsNames in the CSR sent to the finalize endpoint, resulting in EJBCA issuing a certificate including the identifiers that were not validated. This occurs even if the certificate profile is configured to not allow a DN override by the CSR.
Recommendations
For versions prior to 7.9.0, update to version 7.9.0 or later to resolve the issue. As a temporary workaround, consider restricting the ability of non-compliant clients to include additional dnsNames in the CSR sent to the finalize endpoint. Additionally, review and ensure that certificate profiles are properly configured to prevent DN overrides by the CSR.
Fix
Improper Certificate Validation
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Keyfactor Primekey Ejbca