CVE-2008-5082
published 2009-01-30CVE-2008-5082: The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0…
PriorityP427medium6CVSS 2.0
AVNACMAuSCPIPAP
EPSS
0.78%
51.7th percentile
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| redhat | certificate_system | — | — |
| redhat | certificate_system | — | — |
| redhat | certificate_system | — | — |
| redhat | dogtag_certificate_system | — | — |
CVSS provenance
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
vendor_redhat6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
System: missing public key challenge proof verification in the TPS component
vendor_redhat·2009-01-29·CVSS 6.0
CVE-2008-5082 [MEDIUM] System: missing public key challenge proof verification in the TPS component
System: missing public key challenge proof verification in the TPS component
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.
GHSA
GHSA-j872-hj4c-mqf5: The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7
ghsa_unreviewed·2022-05-17
CVE-2008-5082 [MEDIUM] CWE-287 GHSA-j872-hj4c-mqf5: The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7
The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.
No detection rules found.
No public exploits indexed.
http://secunia.com/advisories/33693http://www.securityfocus.com/bid/33508http://www.vupen.com/english/advisories/2009/0145https://bugzilla.redhat.com/show_bug.cgi?id=475998https://exchange.xforce.ibmcloud.com/vulnerabilities/48331https://rhn.redhat.com/errata/RHSA-2009-0007.htmlhttp://secunia.com/advisories/33693http://www.securityfocus.com/bid/33508http://www.vupen.com/english/advisories/2009/0145https://bugzilla.redhat.com/show_bug.cgi?id=475998https://exchange.xforce.ibmcloud.com/vulnerabilities/48331https://rhn.redhat.com/errata/RHSA-2009-0007.html
2009-01-30
Published