CVE-2008-5082

Red Hat Certificate System 7.1-7.3 & Dogtag 1.0 - Improper Authentication

Title source: llm

Description

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.

References (6)

Core 6

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/33508

Issue Tracking x_refsource_confirm

https://bugzilla.redhat.com/show_bug.cgi?id=475998

Third Party Advisory, VDB Entry vdb-entry x_refsource_xf

https://exchange.xforce.ibmcloud.com/vulnerabilities/48331

Third Party Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2009/0145

Vendor Advisory vendor-advisory x_refsource_redhat

https://rhn.redhat.com/errata/RHSA-2009-0007.html

Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/33693

Scores

EPSS 0.0077

EPSS Percentile 51.1%

Details

CWE

CWE-287

Status published

Products (4)

redhat/_dogtag_certificate_system 1.0

redhat/certificate_system 7.1

redhat/certificate_system 7.2

redhat/certificate_system 7.3

Published Jan 30, 2009

Tracked Since Feb 18, 2026