CVE-2023-4727

Description

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.

Reserved 2023-09-01 | Published 2024-06-11 | Updated 2024-12-06 | Assigner redhat

Problem types

Authentication Bypass by Primary Weakness

Product status

Default status
unaffected

Any version before 11.5.1
affected

Default status
affected

8060020240529205458.07fb4edf before *
unaffected

Default status
affected

0:10.5.18-32.el7_9 before *
unaffected

Default status
affected

8100020240614102443.82f485b7 before *
unaffected

Default status
affected

8040020240329193548.17df0a3f before *
unaffected

Default status
affected

8040020240329193548.17df0a3f before *
unaffected

Default status
affected

8040020240329193548.17df0a3f before *
unaffected

Default status
affected

8060020240329182634.60523a7b before *
unaffected

Default status
affected

8060020240329182634.60523a7b before *
unaffected

Default status
affected

8060020240329182634.60523a7b before *
unaffected

Default status
affected

8080020240329143735.693a3987 before *
unaffected

Default status
affected

0:11.5.0-2.el9_4 before *
unaffected

Default status
affected

0:11.0.6-3.el9_0 before *
unaffected

Default status
affected

0:11.3.0-2.el9_2 before *
unaffected

Default status
unknown

Timeline

2023-08-15:	Reported to Red Hat.
2024-06-11:	Made public.

Credits

Red Hat would like to thank Pham Van Khanh (Calif) for reporting this issue.

References

access.redhat.com/errata/RHSA-2024:4051 (RHSA-2024:4051) vendor-advisory

access.redhat.com/errata/RHSA-2024:4070 (RHSA-2024:4070) vendor-advisory

access.redhat.com/errata/RHSA-2024:4164 (RHSA-2024:4164) vendor-advisory

access.redhat.com/errata/RHSA-2024:4165 (RHSA-2024:4165) vendor-advisory

access.redhat.com/errata/RHSA-2024:4179 (RHSA-2024:4179) vendor-advisory

access.redhat.com/errata/RHSA-2024:4222 (RHSA-2024:4222) vendor-advisory

access.redhat.com/errata/RHSA-2024:4367 (RHSA-2024:4367) vendor-advisory

access.redhat.com/errata/RHSA-2024:4403 (RHSA-2024:4403) vendor-advisory

access.redhat.com/errata/RHSA-2024:4413 (RHSA-2024:4413) vendor-advisory

access.redhat.com/security/cve/CVE-2023-4727 vdb-entry

bugzilla.redhat.com/show_bug.cgi?id=2232218 (RHBZ#2232218) issue-tracking

cve.org (CVE-2023-4727)

nvd.nist.gov (CVE-2023-4727)

Download JSON