CVE:CVE-2017-7537
CNNVD:CNNVD-201704-338
pki-core是一款为PKI操作提供API的库。
pki-core 10.6.4之前版本存在信任管理问题漏洞，该漏洞源于默认意外启用了一个带有硬编码密码的模拟CMC身份验证插件。攻击者利用该漏洞可以绕过常规身份验证过程并诱使CA服务器颁发证书。
solution:Upgrade redhat enterprise_linux_desktop to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_server to a higher version than 7.0,and avoid the version 7.0; Upgrade redhat enterprise_linux_workstation to a higher version than 7.0,and avoid the version 7.0; Upgrade dogtagpki dogtagpki to a higher version than 10.6.4,and avoid the version (,10.6.4)