p PatchFirst

CVE-2026-71308

CVE-2026-71308 · Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates

Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. Assigning those objects to Certificate.replaces invoked an append listener that disabled the victim certificate notifications and marked it as replaced. The victim was then excluded from get_all_pending_reissue, and certificate_rotate could deploy the attacker certificate to endpoints serving the victim. An authenticated non-read-only user could target certificates for which the user had no ownership or role, suppress lifecycle automation, and cause fleet-wide TLS disruption or unauthorized substitution. The fix authorizes every referenced replacement certificate before mutation. This issue is fixed in version 1.9.3.

CVSS 8.1 · Élevée · EPSS 0,3% · Correctif disponible

Publication
Mise à jour

Pile logicielle: python

Produits et versions concernés

  • lemur

    Versions du logiciel
    • >= 0.5.0, < 1.9.3: Concernée

    Aucun correctif publié

  • lemur PyPI

    Versions du logiciel
    • 0.11.0
    • 0.8.0
    • 0.8.1
    • 0.9.0
    • 1.0.0
    • 1.1.0
    • 1.2.0
    • 1.3.1
    • 1.3.2
    • 1.4.0
    • 1.5.0
    • 1.6.0
    • 1.7.0
    • 1.8.0
    • 1.8.1
    • 1.8.2
    • 1.9.0
    • 1.9.1
    • 1.9.2
    Plages de versions concernées
    • ECOSYSTEM: ≥ 0.5.0, < 1.9.3

    Mettez à jour vers 1.9.3

Sources originales

Vérifiez votre serveur →