CVE-2026-17039: falha de baixa gravidade em Red Hat Certificate System 10
Pki-core: dogtag-pki: redhat-pki: pki-core: ca renewal request processing omits realm authorization check performed by enrollment path
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
8Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 3.1epss 0.3%
A flaw was found in pki-core. The certificate authority (CA) renewal request path does not perform the realm-based authorization check that the enrollment path performs, allowing an authenticated user entitled to one realm to cause a certificate belonging to a different realm to be renewed without that realm's authorization.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N
Produtos afetados
Red Hat · Red Hat Certificate System 10Red Hat · Red Hat Certificate System 11Red Hat · Red Hat Certificate System 9Red Hat · Red Hat Enterprise Linux 10Red Hat · Red Hat Enterprise Linux 6Red Hat · Red Hat Enterprise Linux 7Red Hat · Red Hat Enterprise Linux 8Red Hat · Red Hat Enterprise Linux 9CVEs relacionadas — Red Hat Certificate System 10
No mesmo produto, das mais perigosas para as menos.
CVE-2026-89059HIGHResteasy-core: resteasy: iioimageprovider unbounded image decode (decompression-bomb dos)EPSS 1.5%CVE-2026-76561HIGHPki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint)EPSS 0.8%CVE-2026-18047MEDIUMDogtag-pki: pki-core: redhat-pki: pki: acme admin enable/disable endpoint authentication bypass via trailing slashEPSS 0.5%CVE-2026-89058HIGHResteasy-core: resteasy: corsfilter reflects arbitrary origin with credentials under wildcard configEPSS 0.5%CVE-2026-11873MEDIUMPki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosureEPSS 0.5%CVE-2026-12353MEDIUMRhcs: memory leak during https connection leads to denial of serviceEPSS 0.4%
Referências
https://access.redhat.com/security/cve/CVE-2021-20179https://access.redhat.com/security/cve/CVE-2026-17039https://bugzilla.redhat.com/show_bug.cgi?id=2506720https://github.com/dogtagpki/pki/blob/master/base/ca/database/ds/acl.ldifhttps://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/EnrollmentProcessor.javahttps://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/com/netscape/cms/servlet/cert/RenewalProcessor.javahttps://github.com/dogtagpki/pki/blob/master/base/ca/src/main/java/org/dogtagpki/server/ca/rest/v2/CertServlet.javahttps://github.com/dogtagpki/pki/commit/e2de26769761af04b9c56071bd1a1926903c49b6