CVE-2020-28942

描述

An issue exists in PrimeKey EJBCA before 7.4.3 when enrolling with EST while proxied through an RA over the Peers protocol. As a part of EJBCA's domain security model, the peer connector allows the restriction of client certificates (for the RA, not the end user) to a limited set of allowed CAs, thus restricting the accessibility of that RA to the rights it has within a specific role. While this works for other protocols such as CMP, it was found that the EJBCA enrollment over an EST implementation bypasses this check, allowing enrollment with a valid client certificate through any functioning and authenticated RA connected to the CA. NOTE: an attacker must already have a trusted client certificate and authorization to enroll against the targeted CA.

如何修補 CVE-2020-28942

要修補 CVE-2020-28942,請將受影響套件升級到下列已修補版本。

• —升級至 7.4.3 或更新版本

CVE-2020-28942 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 7.4.3

CVSS 分數

參考連結(2)

• WEBnvd.nist.gov/vuln/detail/CVE-2020-28942
• WEBsupport.primekey.com/news/posts/40