CVEvulnerability
CVE-2008-5082
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-01-30
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.
Affected configurations
• redhat dogtag certificate system 1.0
• redhat certificate system 7.1
• redhat certificate system 7.2
• redhat certificate system 7.3
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://secunia.com/advisories/33693 Vendor Advisory
- http://www.securityfocus.com/bid/33508 www.securityfocus.com
- http://www.vupen.com/english/advisories/2009/0145 www.vupen.com
- https://bugzilla.redhat.com/show_bug.cgi?id=475998 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48331 exchange.xforce.ibmcloud.com
- https://rhn.redhat.com/errata/RHSA-2009-0007.html Vendor Advisory
- http://secunia.com/advisories/33693 Vendor Advisory
- http://www.securityfocus.com/bid/33508 www.securityfocus.com
- http://www.vupen.com/english/advisories/2009/0145 www.vupen.com
- https://bugzilla.redhat.com/show_bug.cgi?id=475998 bugzilla.redhat.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/48331 exchange.xforce.ibmcloud.com
- https://rhn.redhat.com/errata/RHSA-2009-0007.html Vendor Advisory