Certificate SystemApplication · Redhat
CVE-2022-2393
Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.
NVD · uneditedA flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able to decrypt message content.
Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.
dbcve analysis · moderate confidenceA flaw in pki-core's certificate issuance process allows an authenticated attacker with adjacent network access to obtain a certificate for another user's identity when directory-based authentication is enabled. This enables user impersonation within the domain scope, though the attacker cannot decrypt existing message content.
Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.
Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.
NVD · CPE data
Certificate SystemApplication
= 9.0= 10.0
Enterprise LinuxOperating system
= 6.0= 7.0= 8.0= 9.0<= 10.12.4CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.
From the vector- Attack vector
- Adjacent
- Complexity
- Low
- Privileges
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.
dbcve checksWork through these to decide whether this CVE applies to you.
-
Identify if pki-core is installedQuery the system package manager or check for pki-core packages (e.g., rpm -qa | grep pki-core, dpkg -l | grep pki-core, or yum list installed pki-core)Affected if pki-core package is present on the system
-
Determine the installed pki-core versionRun package manager query to get the exact version number (e.g., rpm -q pki-core or yum info pki-core)Affected if The installed version is 10.12.4 or lower, or matches Red Hat Certificate System 9.0/10.0, or Red Hat Enterprise Linux 6.0-9.0
-
Verify if directory-based authentication is enabledExamine the PKI configuration files and subsystem settings for directory integration (typically in /var/lib/pki/*/conf or /etc/pki/* directory, look for LDAP or directory service configuration parameters in the authentication setup)Affected if Directory-based authentication (LDAP/active directory) is configured and enabled for the CA subsystem
-
Inspect certificate request authorization configurationReview the CA subsystem's certificate request validation settings in the configuration files, specifically checking the authorization logic for certificate requests tied to directory identitiesAffected if The authorization logic allows certificate issuance for identities other than the authenticated requestor's directory identity (the vulnerability condition)
-
Review audit logs for suspicious certificate requestsExamine PKI CA audit logs for certificate requests where the subject DN differs from the authenticated requestor's directory identityAffected if Certificate requests exist that issued certificates for identities not matching the authenticated requestor
-
Check network accessibility of PKI servicesVerify if PKI CA services are accessible from adjacent network segments (non-localhost interfaces)Affected if PKI CA services are exposed on network interfaces accessible to adjacent attackers
A system is affected if pki-core is installed with a vulnerable version AND directory-based authentication is enabled, allowing an attacker with adjacent network access to request certificates for other users' identities.
Generated from the published advisory. Verify against your own configuration.
Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.
From vendor dataReview and strengthen certificate request authorization logic in pki-core to ensure proper validation that requestors can only obtain certificates for their own verified identity within the directory service.
Fix this in Certificate System
Scoped from the published advisory
- Consultation8.0 h
- Implementation16.0 h
- Testing12.0 h
- Review / QA8.0 h
An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $12,352.
Scan for this in your stack
Free · runs locallyCheck whether your project pulls in CVE-2022-2393 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.
References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.
Primary sourcesPractitioner notes
ContributedPeer-ranked notes from engineers who’ve handled CVE-2022-2393 in production — separate from our analysis above.
The advisory tells you what broke. It rarely tells you what actually worked. If you’ve dealt with this one, that detail is what the next engineer is searching for.
- The version that genuinely resolved it — not the one the vendor claimed
- A config change or rule that shut the vector down
- A gotcha in the upgrade path that cost you an afternoon
No notes yet
Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.
A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.
- Verified mitigations, workarounds, and config changes
- Version or environment caveats, and links to real fixes
- No weaponised exploit code, or anything meant to cause harm
- No spam, self-promotion, credentials, or personal data