{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated rhpki-common packages that fix a security issue are now available\nfor Red Hat Certificate System 7.2.\n\nThis update has been rated as having important security impact by the Red\nHat Security Response Team.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Certificate System (RHCS) is an enterprise software system designed\nto manage enterprise Public Key Infrastructure (PKI) deployments.\n\nrhpki-common -- the Red Hat PKI Common Framework -- is required by the\nfollowing four RHCS subsystems: the Red Hat Certificate Authority; the Red\nHat Data Recovery Manager; the Red Hat Online Certificate Status Protocol\nManager; and the Red Hat Token Key Service.\n\nA flaw was found in the way Red Hat Certificate System handled Extensions\nin the certificate signing requests (CSR). All requested Extensions were\nadded to the issued certificate even if constraints were defined in the\nCertificate Authority (CA) profile. An attacker could submit a CSR for a\nsubordinate CA certificate even if the CA configuration prohibited\nsubordinate CA certificates. This lead to a bypass of the intended security\npolicy, possibly simplifying man-in-the-middle attacks against users that\ntrust Certificate Authorities managed by Red Hat Certificate System.\n(CVE-2008-1676)\n\nAll users of Red Hat Certificate System 7.2 should upgrade to these updated\npackages, which resolves this issue.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2008:0577",
        "url": "https://access.redhat.com/errata/RHSA-2008:0577"
      },
      {
        "category": "external",
        "summary": "http://www.redhat.com/security/updates/classification/#important",
        "url": "http://www.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "445227",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=445227"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2008/rhsa-2008_0577.json"
      }
    ],
    "title": "Red Hat Security Advisory: rhpki-common security update",
    "tracking": {
      "current_release_date": "2024-11-22T02:01:21+00:00",
      "generator": {
        "date": "2024-11-22T02:01:21+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2008:0577",
      "initial_release_date": "2008-07-02T17:50:00+00:00",
      "revision_history": [
        {
          "date": "2008-07-02T17:50:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2008-07-02T13:54:05+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T02:01:21+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Certificate System 7.2 for 4AS",
                "product": {
                  "name": "Red Hat Certificate System 7.2 for 4AS",
                  "product_id": "4AS-CERT-7.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:certificate_system:7.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Certificate System 7.2 for 4ES",
                "product": {
                  "name": "Red Hat Certificate System 7.2 for 4ES",
                  "product_id": "4ES-CERT-7.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:certificate_system:7.2"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Certificate System"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhpki-common-0:7.2.0-11.noarch",
                "product": {
                  "name": "rhpki-common-0:7.2.0-11.noarch",
                  "product_id": "rhpki-common-0:7.2.0-11.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhpki-common@7.2.0-11?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-common-0:7.2.0-11.noarch as a component of Red Hat Certificate System 7.2 for 4AS",
          "product_id": "4AS-CERT-7.2:rhpki-common-0:7.2.0-11.noarch"
        },
        "product_reference": "rhpki-common-0:7.2.0-11.noarch",
        "relates_to_product_reference": "4AS-CERT-7.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhpki-common-0:7.2.0-11.noarch as a component of Red Hat Certificate System 7.2 for 4ES",
          "product_id": "4ES-CERT-7.2:rhpki-common-0:7.2.0-11.noarch"
        },
        "product_reference": "rhpki-common-0:7.2.0-11.noarch",
        "relates_to_product_reference": "4ES-CERT-7.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2008-1676",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "discovery_date": "2008-04-17T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "445227"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "Red Hat PKI Common Framework (rhpki-common) in Red Hat Certificate System (aka Certificate Server or RHCS) 7.1 through 7.3, and Netscape Certificate Management System 6.x, does not recognize Certificate Authority profile constraints on Extensions, which might allow remote attackers to bypass intended restrictions and conduct man-in-the-middle attacks by submitting a certificate signing request (CSR) and using the resulting certificate.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "System: incorrect handling of Extensions in CSRs (cs71)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "4AS-CERT-7.2:rhpki-common-0:7.2.0-11.noarch",
          "4ES-CERT-7.2:rhpki-common-0:7.2.0-11.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2008-1676"
        },
        {
          "category": "external",
          "summary": "RHBZ#445227",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=445227"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2008-1676",
          "url": "https://www.cve.org/CVERecord?id=CVE-2008-1676"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2008-1676",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2008-1676"
        }
      ],
      "release_date": "2008-07-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2008-07-02T17:50:00+00:00",
          "details": "Users running Red Hat Certificate System on Red Hat Enterprise Linux:\n\nBefore applying this update, make sure that all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via Red Hat Network. Details on how to use the Red\nHat Network to apply this update are available at\nhttp://kbase.redhat.com/faq/FAQ_58_10188\n\nUsers running Red Hat Certificate System on Sun Solaris:\n\nAn updated Solaris packages in .pkg format are available in the Red Hat\nCertificate System Solaris channels on the Red Hat Network. This packages\nshould be installed/upgraded using Solaris native package management tools.\n\nSee also Red Hat Certificate System Administration Guide for installation\ninstructions:\nhttp://www.redhat.com/docs/manuals/cert-system/",
          "product_ids": [
            "4AS-CERT-7.2:rhpki-common-0:7.2.0-11.noarch",
            "4ES-CERT-7.2:rhpki-common-0:7.2.0-11.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2008:0577"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "PARTIAL",
            "baseScore": 7.5,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
            "version": "2.0"
          },
          "products": [
            "4AS-CERT-7.2:rhpki-common-0:7.2.0-11.noarch",
            "4ES-CERT-7.2:rhpki-common-0:7.2.0-11.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "System: incorrect handling of Extensions in CSRs (cs71)"
    }
  ]
}