CVE-2017-7537

Name of the Vulnerable Software and Affected Versions pki-core versions prior to 10.6.4

Description A flaw was discovered in the pki-core package where a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default. This could allow an attacker to bypass the regular authentication process and trick the CA server into issuing certificates.

Recommendations For versions prior to 10.6.4, update to version 10.6.4 or later to resolve the issue. As a temporary workaround, consider disabling the mock CMC authentication plugin until a patch is available.