Vulnerabilidades do Fortra BoKS Manager

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Fortra BoKS Manager: 3 registro(s), com versões afetadas e correções.

CVE-2026-79896 Alta · 7.5 CWE-125 01/10/2026

Fortra BoKS Manager boks_portmux TLS ClientHello out-of-bounds read vulnerability

Fortra BoKS Manager contains an out-of-bounds read vulnerability in the custom TLS ClientHello parser used by boks_portmux. A remote unauthenticated attacker can submit a malformed ClientHello and terminate boks_portmux. Although the daemon is normally restarted automatically, repeated requests can sustain the service interruption.

CVE-2026-79899 Alta · 7.9 CWE-377 01/10/2026

Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKS_tmp may be able to obtain CA secret or host private-key material while the utility runs, or obtain CA secret material left behind after successful certificate creation.

CVE-2026-79898 Crítica · 9.1 CWE-78 01/10/2026

Fortra BoKS Manager crlserver command injection vulnerability

Fortra BoKS Manager contains a command injection vulnerability in crlserver. An authenticated user authorized to add CRL URLs through BCC, the WSI REST or SOAP API, or the cacrl command-line interface could cause shell command substitution to be processed by crlserver as root on the BoKS Master. BCC and WSI provide network-accessible administration paths and do not require a local sudo or suexec rule; non-root use of cacrl requires such a rule.