SZB-ee9c9ce24e
Keyfactor EJBCA 9 flaw may let removed administrators keep access via cached TLS sessions
- Status
- Unverified: only social posts report this so far
- Kind
- Vulnerability
- Vendor
- Keyfactor
- Product
- EJBCA
- First seen
Summary
The EUVD database entry says EJBCA 9 may cache authentication for longer than the configured maximum after an administrator is removed from the administrator role, if that administrator has a valid TLS session. No severity score is listed in the entry.
If you use Keyfactor
Check the vendor advisory for a fixed EJBCA release and apply it
Revoke or re-issue TLS client certificates for administrators whose roles changed
Restart EJBCA services after updating so cached sessions are cleared
What the sources say 1
· Mastodon: “An issue was discovered in Keyfactor EJBCA 9.” Source