Krill trusts a local parent as authenticated, letting a CA operator act as any child
An internet address certificate server lets operators take over other authorities.
Summary
Krill treats a parent CA on the same server as already authenticated, so an operator can act as any child of any CA on that server. Krill 0.16.0 and earlier are affected.
Affected when
- Parent CA on the same Krill server
- Krill 0.16.0 and earlier
What to do
Update to Krill 0.16.1 or later.
Products and platforms
CVE IDs
Sources
- Advisory: nlnetlabs.nl (opens in a new tab)
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen