Every CVESearch/Get API key

CVE-2008-5082

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate...

6.0 Medium

CVE-2008-5082 is a medium vulnerability (CVSS 6.0) in Redhat Dogtag Certificate System, published January 30, 2009. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. No source names a fixed version.

What does this mean?
Severity
6.0 MediumCVSS 2.0, NVD
Exploit chance
0.78%EPSS, 56th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
No fix listedNo source names one

Description

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.

Exploit likelihood

0.78%Down 0.5 points since Feb 4, 2022
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
pkisetup
Red Hat:certificate_system:7.3
From an advisory covering 3 CVEs
before 0:7.3.0-14.el4
0:7.3.0-14.el4
rhpki-ca
Red Hat:certificate_system:7.3
From an advisory covering 3 CVEs
before 0:7.3.0-17.el4
0:7.3.0-17.el4
rhpki-common
Red Hat:certificate_system:7.3
From an advisory covering 3 CVEs
before 0:7.3.0-40.el4
0:7.3.0-40.el4
rhpki-kra
Red Hat:certificate_system:7.3
From an advisory covering 3 CVEs
before 0:7.3.0-13.el4
0:7.3.0-13.el4
rhpki-ocsp
Red Hat:certificate_system:7.3
From an advisory covering 3 CVEs
before 0:7.3.0-11.el4
0:7.3.0-11.el4
rhpki-ra
Red Hat:certificate_system:7.3
From an advisory covering 3 CVEs
before 0:7.3.0-67.el4
0:7.3.0-67.el4
rhpki-tks
Red Hat:certificate_system:7.3
From an advisory covering 3 CVEs
before 0:7.3.0-12.el4
0:7.3.0-12.el4
rhpki-tps
Red Hat:certificate_system:7.3
From an advisory covering 3 CVEs
before 0:7.3.0-23.el4
0:7.3.0-23.el4
rhpki-util
Red Hat:certificate_system:7.3
From an advisory covering 3 CVEs
before 0:7.3.0-20.el4
0:7.3.0-20.el4

What each source reports

NVD Score used6.0

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.

Record
CVE-2008-5082
CVSS 2.0
6.0 MediumAV:N/AC:M/Au:S/C:P/I:P/A:P
Weakness
CWE-287
Updated
2026-11-02
CVE ListNo score

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.

Record
CVE-2008-5082
Updated
2026-11-02
EUVDEUVD-2008-5061No score

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.

Record
EUVD-2008-5061
Updated
2026-11-03
GitHub AdvisoriesGHSA-j872-hj4c-mqf5No score

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate...

The verifyProof function in the Token Processing System (TPS) component in Red Hat Certificate System (RHCS) 7.1 through 7.3 and Dogtag Certificate System 1.0 returns successfully even when token enrollment did not use the hardware key, which allows remote authenticated users with enrollment privileges to bypass intended authentication policies by performing enrollment with a software key.

Record
GHSA-j872-hj4c-mqf5
Weakness
CWE-287
Updated
2026-11-02

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

Show 16 moreShow less
PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open