Weak Encryption Vulnerability in Easy-RSA: CVE-2024-13454
Summary
CVE-2024-13454: Weak encryption algorithm in Easy-RSA version 3.0.5 through 3.1.7 allows a local attacker to more easily bruteforce the private CA key when created using OpenSSL 3. Affects easy-rsa versions 3.1.0-1 – 3.2.3-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Easy-RSA is a CLI utility that simplifies the process of managing a public key infrastructure (PKI) for OpenVPN and other applications. It allows users to create and manage their own Certificate Authority (CA) and generate SSL certificates. The affected versions, from 3.0.5 to 3.1.7, utilize a weak encryption algorithm when generating private CA keys using OpenSSL 3, making them susceptible to brute-force attacks.
Vulnerability Detail
The vulnerability identified as CVE-2024-13454 arises from the use of a weak encryption algorithm in Easy-RSA versions 3.0.5 through 3.1.7. This flaw allows local attackers to potentially brute-force the private CA key, compromising the security of the entire PKI. The implications of this vulnerability are significant, as it could lead to unauthorized access to encrypted communications, data breaches, and loss of integrity in the certificate management process.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected versions of Easy-RSA and consider generating CA keys using a different tool or method that employs stronger encryption algorithms until an upgrade can be performed.
Conclusion
The vulnerability CVE-2024-13454 in Easy-RSA poses a significant risk due to the use of a weak encryption algorithm that allows for brute-force attacks on the private CA key. Users are strongly advised to update to the patched version to secure their PKI infrastructure.
See every vulnerability recorded for easy-rsa →
FAQ
CVE-2024-13454 is a vulnerability in Easy-RSA that allows local attackers to brute-force the private CA key due to a weak encryption algorithm.
Easy-RSA versions 3.0.5 through 3.1.7 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The consequences include unauthorized access to encrypted communications, data breaches, and loss of integrity in the certificate management process.
Yes, a patch is available in Easy-RSA version 3.2.0-1 and later. Users should update to this version to mitigate the vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for easy-rsa.
