CVE-2021-40088

描述

An issue was discovered in PrimeKey EJBCA before 7.6.0. CMP RA Mode can be configured to use a known client certificate to authenticate enrolling clients. The same RA client certificate is used for revocation requests as well. While enrollment enforces multi tenancy constraints (by verifying that the client certificate has access to the CA and Profiles being enrolled against), this check was not performed when authenticating revocation operations, allowing a known tenant to revoke a certificate belonging to another tenant.

如何修補 CVE-2021-40088

要修補 CVE-2021-40088,請將受影響套件升級到下列已修補版本。

• —升級至 7.6.0 或更新版本

CVE-2021-40088 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 7.6.0

CVSS 分數

參考連結(2)

• WEBnvd.nist.gov/vuln/detail/CVE-2021-40088
• WEBsupport.primekey.com/news/posts/51