Dear OpenXPKI users,
We would like to inform you about a recently discovered critical
vulnerability in OpenXPKI.
On affected systems, an attacker can send a TLS client certificate to an
enrollment endpoint or to the WebUI and be authenticated with it,
without having the matching private key. This makes it possible to renew
arbitrary certificates, or to act as a registrar on registrar endpoints
and request any certificate the endpoint's policy allows.
The cause is that the web server forwards and filters request data
incorrectly. Only systems that meet both of these conditions are affected:
* they run the new Mojolicious-based frontend (openxpki-clientd),
which is included from release 3.32.2 onwards, including 3.34, and
* they use the Apache web server with a configuration based on our
sample configuration.
Installations using the nginx sample configuration, the legacy FCGI
frontend, or releases before 3.32 are not affected.
To fix the problem, you only need to correct the Apache configuration.
You don't need to install new packages or upgrade OpenXPKI. Upgrading
the packages also won't change an Apache configuration that is already
deployed, so every existing installation has to be reviewed and fixed
manually.
The advisory explains how to check whether your installation is affected
and how to apply and verify the fix, you can find it on the Website at
https://www.openxpki.org/download/WRS-SA-2026-002.pdf. An updated
configuration file is also provided on the config repository
https://github.com/openxpki/openxpki-config.
Best regards,
Oliver
--
Protect your environment - close windows and adopt a penguin!
_______________________________________________
OpenXPKI-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/openxpki-users
