CVE-2022-21672— make-ca 安全漏洞

/etc/pki/tls and /etc/ssl/certs include distrusted certificates in make-ca

make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to version 1.10, make-ca misinterprets Mozilla certdata.txt and treats explicitly untrusted certificates like trusted ones, causing those explicitly untrusted certificates trusted by the system. The explicitly untrusted certificates were used by some CAs already hacked. Hostile attackers may perform a MIM attack exploiting them. Everyone using the affected versions of make-ca should upgrade to make-ca-1.10, and run `make-ca -f -g` as the `root` user to regenerate the trusted store immediately. As a workaround, users may delete the untrusted certificates from /etc/pki/tls and /etc/ssl/certs manually (or by a script), but this is not recommended because the manual changes will be overwritten next time running make-ca to update the trusted anchor.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

输入的错误解释

make-ca 安全漏洞

Make-Ca是一个提供和管理完整 Pki 配置的实用程序。 make-ca存在安全漏洞，该漏洞源于从0.9和1.10之前的版本开始，make-ca会误解Mozilla certdata.txt，并将显式不受信任的证书视为受信任的证书，导致显式不受信任的证书受到系统的信任。一些已被黑客攻击的ca使用了显式不受信任的证书。敌方攻击者可利用该漏洞可以利用它们进行MIM攻击。所有使用受影响版本的make-ca的用户都应该升级到make-ca-1.10，并以root用户身份运行-命令进行恢复。

N/A

N/A