Vulnerability in Dogtag PKI Affects Certificate Validation

CVE-2020-15720

What is CVE-2020-15720?

In Dogtag PKI versions prior to 10.9.0-b1, the pki.client.PKIConnection class failed to implement proper certificate validation due to a hard-coded 'verify' parameter in all request functions. This oversight rendered systems using this class susceptible to interception through Person-in-the-Middle attacks, particularly in environments outside of localhost. The vulnerability has been addressed in the subsequent release, ensuring enhanced security for users.

References