A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.

The remote Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:4165 advisory.

    * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727)

Tenable has extracted the preceding description block directly from the Rocky Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4222 advisory.

    - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
      token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
    - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
      token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
    - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
      token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
    - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
      token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
    - RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca:
      token authentication bypass vulnerability [rhel-7.9.z] (jmagne)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4222 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4179 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2024-4165 advisory.

    [11.5.0-2.0.1]
    - Replaced upstream graphical references [Orabug: 33952704]

    [11.5.0-2]
    - RHEL-9916 CVE-2023-4727 pki-core: dogtag ca: token authentication bypass vulnerability

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2024:4165 advisory.

    * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727)

Tenable has extracted the preceding description block directly from the AlmaLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4165 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4164 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4070 advisory.

    Red Hat Certificate System (RHCS) is a complete implementation of an enterprise software system designed     to manage enterprise Public Key Infrastructure (PKI) deployments.

    Security fixes:

    - Token authentication bypass vulnerability (BZ2232221 - CVE-2023-4727)
    - Renaming the option ops-flag and ops-flag-mask (BZ2275455)
    - Rebase to TomcatJSS 7.7.4
    - Rename enableOCSP to enableRevocationCheck (BZ2275095)
    - Rebase to JSS 4.9.9
    - Enable revocation verification using CRL-DP (BZ2274531)

    Users of RHCS 10 are advised to upgrade to these updated packages.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4051 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * dogtag ca: token authentication bypass vulnerability (CVE-2023-4727)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
201856	Rocky Linux 9 : pki-core (RLSA-2024:4165)	Nessus	Rocky Linux Local Security Checks	high
201299	Oracle Linux 7 : pki-core (ELSA-2024-4222)	Nessus	Oracle Linux Local Security Checks	high
201289	RHEL 7 : pki-core (RHSA-2024:4222)	Nessus	Red Hat Local Security Checks	high
201174	RHEL 8 : pki-core (RHSA-2024:4179)	Nessus	Red Hat Local Security Checks	high
201121	Oracle Linux 9 : pki-core (ELSA-2024-4165)	Nessus	Oracle Linux Local Security Checks	high
201118	AlmaLinux 9 : pki-core (ALSA-2024:4165)	Nessus	Alma Linux Local Security Checks	high
201093	RHEL 9 : pki-core (RHSA-2024:4165)	Nessus	Red Hat Local Security Checks	high
201092	RHEL 8 : pki-core (RHSA-2024:4164)	Nessus	Red Hat Local Security Checks	high
200882	RHEL 8 : Red Hat Certificate System 10.4 for RHEL 8 (RHSA-2024:4070)	Nessus	Red Hat Local Security Checks	high
200869	RHEL 9 : pki-core (RHSA-2024:4051)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2023-4727

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high