CVE-2020-15720
published 2020-07-14CVE-2020-15720: In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was…
PriorityP430medium6.8CVSS 3.1
AVNACHPRNUIRSUCHIHAN
EPSS
1.01%
59.3th percentile
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | dogtag-pki | < dogtag-pki 10.9.1-1 (bullseye) | dogtag-pki 10.9.1-1 (bullseye) |
| dogtagpki | dogtagpki | <= 10.8.3 | — |
CVSS provenance
nvdv3.16.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
nvdv2.04.0MEDIUMAV:N/AC:H/Au:N/C:P/I:P/A:N
osv6.8MEDIUM
vendor_debian6.8MEDIUM
vendor_redhat6.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
pki: Dogtag's python client does not validate certificates
vendor_redhat·2020-06-23·CVSS 6.8
CVE-2020-15720 [MEDIUM] CWE-295 pki: Dogtag's python client does not validate certificates
pki: Dogtag's python client does not validate certificates
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
A flaw was found in PKI, where the dogtag's pki.client.PKIConnection class disables the python-requests certificate validation. This flaw allows an attacker to intercept a connection between a FreeIPA client and a server, and execute an active Man-in-the-Middle attack. The highest threat from this vulnerabi
Debian
CVE-2020-15720: dogtag-pki - In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable ...
vendor_debian·2020·CVSS 6.8
CVE-2020-15720 [MEDIUM] CVE-2020-15720: dogtag-pki - In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable ...
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
Scope: local
bullseye: resolved (fixed in 10.9.1-1)
GHSA
GHSA-hpcm-hcj8-c96c: In Dogtag PKI through 10
ghsa_unreviewed·2022-05-24
CVE-2020-15720 [MEDIUM] GHSA-hpcm-hcj8-c96c: In Dogtag PKI through 10
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
OSV
CVE-2020-15720: In Dogtag PKI through 10
osv·2020-07-14·CVSS 6.8
CVE-2020-15720 [MEDIUM] CVE-2020-15720: In Dogtag PKI through 10
In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2020-15720 pki-core: pki: dogtag's Python client does not validate certificate [fedora-all]
bugzilla·2020-07-10·CVSS 6.8
CVE-2020-15720 [MEDIUM] CVE-2020-15720 pki-core: pki: dogtag's Python client does not validate certificate [fedora-all]
CVE-2020-15720 pki-core: pki: dogtag's Python client does not validate certificate [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple
Bugzilla
CVE-2020-15720 pki: Dogtag's python client does not validate certificates
bugzilla·2020-07-09·CVSS 6.8
CVE-2020-15720 [MEDIUM] CVE-2020-15720 pki: Dogtag's python client does not validate certificates
CVE-2020-15720 pki: Dogtag's python client does not validate certificates
Dogtag's pki.client.PKIConnection class disables python-requests certificate validation. The argument `verify=False` means that no certificate validation is performed at all [2]. The client accepts any certificate. Since the verify parameter is hard-coded in all request functions, it is not possible to override the setting.
PKIConnection should use requests default settings (verify with default certs) and offer an API to override default CA certs or disable requests.
[2] https://requests.readthedocs.io/en/master/user/advanced/#ssl-cert-verification
Discussion:
Acknowledgments:
Name: Christian Heimes
---
Created pki-core tracking bugs for this issue:
Affects: fedora-all [bug 1855854]
---
Upstream fix : http
https://bugzilla.redhat.com/show_bug.cgi?id=1855273https://github.com/dogtagpki/pki/commit/50c23ec146ee9abf28c9de87a5f7787d495f0b72https://github.com/dogtagpki/pki/compare/v10.9.0-a2...v10.9.0-b1https://bugzilla.redhat.com/show_bug.cgi?id=1855273https://github.com/dogtagpki/pki/commit/50c23ec146ee9abf28c9de87a5f7787d495f0b72https://github.com/dogtagpki/pki/compare/v10.9.0-a2...v10.9.0-b1
2020-07-14
Published