CVE-2020-15720

Dogtag PKI 10.8.3: Lack of certificate validation in pki.client.PKIConnection class

• CVSS 6.8
• CWE-295 Improper Certificate Validation
• Cryptographic
• Remote

In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.

CVE

CVE-2020-15720

CWE

CWE-295 Improper Certificate Validation

CVSS base score

6.8

Published

2020-07-14

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Function

Code defect classification

Incorrect Functionality

Category

Cryptographic

Subcategory

Improper SSL/TLS Certificate Validation

Accessibility scope

Remote

Impact

Unauthorized Access

Fixed by upgrading

Yes

Solution

Update Dogtag PKI to version 10.9.0-b1 or higher.

import requests

class PKIConnection:
    def __init__(self, base_url):
        self.base_url = base_url

    def get(self, endpoint):
        url = f"{self.base_url}/{endpoint}"
        response = requests.get(url, verify=False)
        return response

    def post(self, endpoint, data):
        url = f"{self.base_url}/{endpoint}"
        response = requests.post(url, json=data, verify=False)
        return response

import requests

class PKIConnection:
    def __init__(self, base_url, verify=True):
        self.base_url = base_url
        self.verify = verify

    def get(self, endpoint):
        url = f"{self.base_url}/{endpoint}"
        response = requests.get(url, verify=self.verify)
        return response

    def post(self, endpoint, data):
        url = f"{self.base_url}/{endpoint}"
        response = requests.post(url, json=data, verify=self.verify)
        return response

@misc{vaitp:cve202015720,
  title        = {{Dogtag PKI 10.8.3: Lack of certificate validation in pki.client.PKIConnection class}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2020},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2020-15720},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2020-15720/}}
}