published September 14, 2022
⚠️ A sneaky inconsistency in DNS identifiers could lead to unvalidated certificates! 🚨 Think of it as a restaurant accepting a reservation made with a name that matches the menu, but when you arrive, they hand you a dish that includes extra ingredients you didn't order — totally unexpected and potentially harmful! This could allow unauthorized parties to receive certificates for domains they don't own, creating a risk of man-in-the-middle attacks. If a malicious actor gets their hands on a valid certificate, they could impersonate a legitimate website, leading to devastating consequences for users and trust in your brand.
Think of it as a restaurant accepting a reservation made with a name that matches the menu, but when you arrive, they hand you a dish that includes extra ingredients you didn't order — totally unexpected and potentially harmful! CVE-2022-34831 affects Keyfactor PrimeKey EJBCA before version 7.9.0, where inconsistencies during the ACME enrollment process let non-compliant clients submit additional dnsNames in the CSR, resulting in the issuance of certificates for unvalidated identifiers.
This could allow unauthorized parties to receive certificates for domains they don't own, creating a risk of man-in-the-middle attacks. If a malicious actor gets their hands on a valid certificate, they could impersonate a legitimate website, leading to devastating consequences for users and trust in your brand. Immediately upgrade to Keyfactor PrimeKey EJBCA version 7.9.0 or later to resolve this issue. Review your ACME configurations to ensure validations are strict and audit existing certificates issued during the vulnerable versions for any potential compromises. You've got this! By taking action now, you can reinforce your security defenses and build trust in your systems. 🛡️