CVE-2010-3868
Fixed in a distro release EPSS 1%
Red Hat Certificate System (RHCS) 7.3 and 8 and Dogtag Certificate System do not require authentication for requests to decrypt SCEP one-time PINs, which allows remote attackers to obtain PINs by sniffing the network for SCEP requests and then sending decryption requests to the Certificate Authority component.
Products: redhat certificate_system, redhat _dogtag_certificate_system
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat certificate system 7.3 | rhpki-ca | 0:7.3.0-21.el4 |
| Red Hat certificate system 7.3 | rhpki-common | 0:7.3.0-41.el4 |
| Red Hat certificate system 7.3 | rhpki-util | 0:7.3.0-21.el4 |
| Red Hat certificate system 8 | pki-ca | 0:8.0.7-1.el5pki |
| Red Hat certificate system 8 | pki-common | 0:8.0.6-2.el5pki |
| Red Hat certificate system 8 | pki-common-javadoc | 0:8.0.6-2.el5pki |
| Red Hat certificate system 8 | pki-util | 0:8.0.5-1.el5pki |
| Red Hat certificate system 8 | pki-util-javadoc | 0:8.0.5-1.el5pki |