Red Hat Certificate System 9
Monthly
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. No public exploit or active exploitation is known at time of analysis, but the CVSS 7.2 / PR:H rating reflects that CA Administrator access is a prerequisite.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.
Authenticated OS command injection in Dogtag PKI's certificate profile import mechanism allows a CA Administrator to achieve code execution as the pkiuser account on RHEL 6-10 and Red Hat Certificate System 9. By uploading a crafted certificate profile that exploits the ExternalProcessConstraint mechanism with attacker-controlled environment variables, a privileged attacker can bypass the limited profile ID validation and execute arbitrary system commands. No public exploit or active exploitation is known at time of analysis, but the CVSS 7.2 / PR:H rating reflects that CA Administrator access is a prerequisite.
Unauthenticated enumeration of internal PKI topology is possible in Red Hat Certificate System 9 through an unprotected REST endpoint. Any network-accessible client can issue GET /ca/rest/securityDomain/hosts and receive a structured inventory of all participating CA subsystem hosts, their roles, and security domain membership - without presenting credentials, a client certificate, or a session token. While the direct CVSS impact is rated medium (5.3), the real-world significance lies in enabling precise reconnaissance of internal PKI infrastructure that could facilitate targeted follow-on attacks against specific subsystems. No active exploitation is confirmed and no public exploit code has been identified at time of analysis.
Server-side request forgery in Dogtag PKI's ACME responder enables unauthenticated ACME account holders to direct the certificate server to make arbitrary HTTP GET requests to internal network addresses. The validator incorrectly accepts IP address literals as valid DNS identifiers and follows HTTP redirects without enforcing RFC-compliant public-address filtering, allowing internal network reconnaissance. When the InMemory database backend is in use, the response body returned by internal services is exposed to the attacker through ACME challenge error messages, compounding the confidentiality impact. No public exploit code or active exploitation has been identified at time of analysis.
Authorization bypass in Red Hat Certificate System's CA renewal path allows an authenticated user to renew a certificate belonging to a different realm without the required realm-based authorization check. Affects versions 9, 10, and 11 of the Certificate System on Red Hat Enterprise Linux 6 through 10. No evidence of active exploitation or public exploit code exists at the time of analysis, and EPSS probability is low (0.21%).
Red Hat Certificate System (RHCS) 9 is susceptible to a resource exhaustion denial-of-service condition triggered by unauthenticated remote attackers flooding its TLS-exposed HTTP endpoint. Repeated requests cause the underlying Java process to exhaust available heap memory, resulting in an Out of Memory crash that takes the certificate authority service offline. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity and absence of authentication requirements make this a realistic threat to any internet- or intranet-exposed RHCS deployment.