CVE-2016-5404

6.5 MEDIUM

Published: September 07, 2016 Modified: May 06, 2026

Description

The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

CVSS v3.x Details

0.0 Low Medium High Critical 10.0

Vector String

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2016-1797.html

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2016/08/17/9

Source: secalert@redhat.com

Mailing List Third Party Advisory

http://www.oracle.com/technetwork/topics/security/linuxbulletinjul2016-3090544.html

Source: secalert@redhat.com

Third Party Advisory

http://www.securityfocus.com/bid/92525

Source: secalert@redhat.com

Third Party Advisory VDB Entry

https://fedorahosted.org/freeipa/ticket/6232

Source: secalert@redhat.com

Issue Tracking

https://git.fedorahosted.org/cgit/freeipa.git/commit/?id=cf74584d0f772f3f5eccc1d30c001e4212a104fd

Source: secalert@redhat.com

Issue Tracking Patch

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3PZ2ZQTMGC2UBRNHXVVOY3PJDOBP4CP4/

Source: secalert@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/S5OROLKFSY5QRQS7NGBNDP5QMOBV3XMZ/

Source: secalert@redhat.com

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VQDYWANTMDFZP3HTGSEOA2IONVUITYX5/

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2016-1797.html