Public Date:
1556657: CVE-2018-1080 pki-core: Mishandled ACL configuration in reverses rules that allow and deny access
Dogtag PKI, through version 10.6.1, has a vulnerability in that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Find out more about CVE-2018-1080 from the MITRE CVE dictionary dictionary and NIST NVD.


This issue affects the versions of pkicore as shipped with Red Hat Certificate System 9. Red Hat Product Security has rated this issue as having security impact of Low. Please also note that all instances of "authz.evaluateOrder" are set to "deny,allow" by default. A future update may address this issue. For additional information, refer to the Issue Severity Classification:

CVSS v3 metrics

CVSS3 Base Score 7.5
CVSS3 Base Metrics CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality High
Integrity Impact High
Availability Impact High

Red Hat Security Errata

Platform Errata Release Date
Red Hat Enterprise Linux 7 (pki-core) RHSA-2018:1979 2018-06-26

Affected Packages State

Platform Package State
Red Hat Enterprise Linux 8 pki-core Not affected
Red Hat Enterprise Linux 6 pki-core Will not fix
Red Hat Certificate System 9 pki-core Will not fix


This issue was discovered by Fraser Tweedale (Red Hat).
Last Modified