Every CVE Search/ Get API key

CVE-2018-1080

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain...

7.5 HighFix available

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.52%Up 0.5 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 7.5

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Record
CVE-2018-1080
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness
CWE-284
Updated
2026-11-02
EUVDEUVD-2018-11732 7.5

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Record
EUVD-2018-11732
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-03
GitHub AdvisoriesGHSA-h277-5r6v-m3gv 8.1

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain...

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Record
GHSA-h277-5r6v-m3gv
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
NVD 7.5

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Record
CVE-2018-1080
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
6.8 MediumAV:N/AC:M/Au:N/C:P/I:P/A:P
Weakness
CWE-284
Updated
2026-11-02
OSV 8.1

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Record
CVE-2018-1080
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2018-1080 8.1

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Record
DEBIAN-CVE-2018-1080
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVRHSA-2018:1979 7.5

Red Hat Security Advisory: pki-core security, bug fix, and enhancement update

Record
RHSA-2018:1979
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2018-1080 8.1

Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process allow rules before deny rules (authz.evaluateOrder=allow,deny), then allow rules will deny access and deny rules will grant access. This may result in an escalation of privileges or have other unintended consequences.

Record
UBUNTU-CVE-2018-1080
CVSS 3.0
8.1 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
7.5 HighCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
dogtag-pki
Debian:11
 before 10.6.6-1
10.6.6-1
pki-base
Red Hat:enterprise_linux:7::client
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-base-java
Red Hat:enterprise_linux:7::client
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-ca
Red Hat:enterprise_linux:7::client
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-core
Red Hat:enterprise_linux:7::client
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-core-debuginfo
Red Hat:enterprise_linux:7::client
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-javadoc
Red Hat:enterprise_linux:7::client
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-kra
Red Hat:enterprise_linux:7::client
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-server
Red Hat:enterprise_linux:7::client
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-symkey
Red Hat:enterprise_linux:7::client
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
Show 32 moreShow less
Affected packages
PackageAffectedFixed
pki-tools
Red Hat:enterprise_linux:7::client
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-base
Red Hat:enterprise_linux:7::computenode
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-base-java
Red Hat:enterprise_linux:7::computenode
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-ca
Red Hat:enterprise_linux:7::computenode
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-core
Red Hat:enterprise_linux:7::computenode
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-core-debuginfo
Red Hat:enterprise_linux:7::computenode
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-javadoc
Red Hat:enterprise_linux:7::computenode
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-kra
Red Hat:enterprise_linux:7::computenode
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-server
Red Hat:enterprise_linux:7::computenode
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-symkey
Red Hat:enterprise_linux:7::computenode
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-tools
Red Hat:enterprise_linux:7::computenode
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-base
Red Hat:enterprise_linux:7::server
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-base-java
Red Hat:enterprise_linux:7::server
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-ca
Red Hat:enterprise_linux:7::server
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-core
Red Hat:enterprise_linux:7::server
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-core-debuginfo
Red Hat:enterprise_linux:7::server
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-kra
Red Hat:enterprise_linux:7::server
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-server
Red Hat:enterprise_linux:7::server
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-symkey
Red Hat:enterprise_linux:7::server
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-tools
Red Hat:enterprise_linux:7::server
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-javadoc
Red Hat:enterprise_linux:7::server
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-base
Red Hat:enterprise_linux:7::workstation
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-base-java
Red Hat:enterprise_linux:7::workstation
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-ca
Red Hat:enterprise_linux:7::workstation
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-core
Red Hat:enterprise_linux:7::workstation
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-core-debuginfo
Red Hat:enterprise_linux:7::workstation
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-kra
Red Hat:enterprise_linux:7::workstation
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-server
Red Hat:enterprise_linux:7::workstation
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-symkey
Red Hat:enterprise_linux:7::workstation
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-tools
Red Hat:enterprise_linux:7::workstation
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
pki-javadoc
Red Hat:enterprise_linux:7::workstation
 before 0:10.5.1-13.1.el7_5
0:10.5.1-13.1.el7_5
dogtag-pki
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
10.2.6-110.2.6-210.2.6-310.2.6+git20160317-110.2.6+git20160317-1ubuntu0.1~esm1
 None known

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-1080 is a high vulnerability (CVSS 7.5) in [unknown] Pki-core, published July 2, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.52%, the 74th percentile. Fixed in dogtag-pki 10.6.6-1.

References

Show 23 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open