CVE-2022-21672
CVE-2022-21672 is a medium-severity vulnerability in Linuxfromscratch Make-ca with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-115.
Key facts
- Severity: Medium (CVSS 3.x base score 6.5)
- CVSS v2: 4.3
- EPSS exploit prediction: 1% (49th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-115
- Affected product: Linuxfromscratch Make-ca
- Published:
- Last modified:
Description
make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to version 1.10, make-ca misinterprets Mozilla certdata.txt and treats explicitly untrusted certificates like trusted ones, causing those explicitly untrusted certificates trusted by the system. The explicitly untrusted certificates were used by some CAs already hacked. Hostile attackers may perform a MIM attack exploiting them. Everyone using the affected versions of make-ca should upgrade to make-ca-1.10, and run `make-ca -f -g` as the `root` user to regenerate the trusted store immediately. As a workaround, users may delete the untrusted certificates from /etc/pki/tls and /etc/ssl/certs manually (or by a script), but this is not recommended because the manual changes will be overwritten next time running make-ca to update the trusted anchor.
Frequently asked questions
- What is CVE-2022-21672?
- make-ca is a utility to deliver and manage a complete PKI configuration for workstations and servers. Starting with version 0.9 and prior to version 1.10, make-ca misinterprets Mozilla certdata.txt and treats explicitly untrusted certificates like trusted ones, causing those explicitly untrusted certificates trusted by the system. The explicitly untrusted certificates were used by some CAs already hacked. Hostile attackers may perform a MIM attack exploiting them. Everyone using the affected versions of make-ca should upgrade to make-ca-1.10, and run `make-ca -f -g` as the `root` user to regenerate the trusted store immediately. As a workaround, users may delete the untrusted certificates from /etc/pki/tls and /etc/ssl/certs manually (or by a script), but this is not recommended because the manual changes will be overwritten next time running make-ca to update the trusted anchor.
- How severe is CVE-2022-21672?
- CVE-2022-21672 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity high, and availability none.
- Is CVE-2022-21672 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (49th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2022-21672?
- CVE-2022-21672 affects Linuxfromscratch Make-ca. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2022-21672?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2022-21672 published?
- CVE-2022-21672 was published on 2022-01-10 and last updated on 2026-06-17.
References
- https://github.com/lfs-book/make-ca/issues/19
- https://github.com/lfs-book/make-ca/pull/20
- https://github.com/lfs-book/make-ca/security/advisories/GHSA-m5qh-728v-4xrx
- https://lists.linuxfromscratch.org/sympa/arc/blfs-support/2022-01/msg00020.html
Affected products (1)
- cpe:2.3:a:linuxfromscratch:make-ca:*:*:*:*:*:*:*:*
Other CWE-115 vulnerabilities
- CVE-2020-27846 — Critical (CVSS 9.8): A signature verification vulnerability exists in crewjam/saml. This flaw allows an attacker to bypass SAML…
- CVE-2020-29511 — Critical (CVSS 9.8): The encoding/xml package in Go (all versions) does not correctly preserve the semantics of element namespace prefixes…
- CVE-2020-29510 — Critical (CVSS 9.8): The encoding/xml package in Go versions 1.15 and earlier does not correctly preserve the semantics of directives during…
- CVE-2020-29509 — Critical (CVSS 9.8): The encoding/xml package in Go (all versions) does not correctly preserve the semantics of attribute namespace prefixes…
- CVE-2023-0880 — High (CVSS 8.3): Misinterpretation of Input in GitHub repository thorsten/phpmyfaq prior to 3.1.11.
- CVE-2025-5747 — High (CVSS 8.0): WOLFBOX Level 2 EV Charger MCU Command Parsing Misinterpretation of Input Remote Code Execution Vulnerability. This…