dogtag-pki: pki-core: redhat-pki: pki: ACME HTTP-01 validation SSRF via IP literal identifiers and unvalidated redirects

A flaw was found in Dogtag PKI's ACME responder where the HTTP-01 challenge validator accepts IP address literals as dns identifiers and follows HTTP redirects without validating that the target is a public address. An unauthenticated ACME account holder can exploit this to perform server-side...

Malicious code in acme-http-01-s3 (npm)

The package acme-http-01-s3 was found to contain malicious code...

MAL-2025-14010 Malicious code in acme-http-01-s3 (npm)

The package acme-http-01-s3 was found to contain malicious code...

Malicious code in acme-http-01-sequelize (npm)

The package acme-http-01-sequelize was found to contain malicious code...

Malicious code in acme-http-01-reddis (npm)

The package acme-http-01-reddis was found to contain malicious code...

MAL-2025-14009 Malicious code in acme-http-01-reddis (npm)

The package acme-http-01-reddis was found to contain malicious code...

MAL-2025-14011 Malicious code in acme-http-01-sequelize (npm)

The package acme-http-01-sequelize was found to contain malicious code...