pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

An update is available for jackson-core, ldapjdk, glassfish-jaxb-api, glassfish-fastinfoset, xalan-j2, apache-commons-net, xmlstreambuffer, jackson-annotations, jackson-databind, pki-servlet-engine, apache-commons-lang, jackson-module-jaxb-annotations, apache-commons-collections, tomcatjss,...

EulerOS 2.0 SP5 : pki-core (EulerOS-SA-2021-1910)

According to the versions of the pki-core packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in pki-core. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting XSS attack to inject co...

EulerOS 2.0 SP8 : pki-core (EulerOS-SA-2021-1885)

According to the version of the pki-core package installed, the EulerOS installation on the remote host is affected by the following vulnerability : - A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate over a...

Huawei EulerOS: Security Advisory for pki-core (EulerOS-SA-2021-1831)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2020-1721

A flaw was found in the Key Recovery Authority KRA Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting XSS vulnerability. An attacker could trick an authenticated victim into executing...

CVE-2020-1721

A flaw was found in the Key Recovery Authority KRA Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting XSS vulnerability. An attacker could trick an authenticated victim into executing...

Cross site scripting

A flaw was found in the Key Recovery Authority KRA Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting XSS vulnerability. An attacker could trick an authenticated victim into executing...

CVE-2020-1721

A flaw was found in the Key Recovery Authority KRA Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting XSS vulnerability. An attacker could trick an authenticated victim into executing...

UBUNTU-CVE-2020-1721

A flaw was found in the Key Recovery Authority KRA Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting XSS vulnerability. An attacker could trick an authenticated victim into executing...

CVE-2020-1721

CVE-2020-1721 is a reflected XSS in the Key Recovery Authority (KRA) Agent Service of pki-core (10.x). The vulnerability arises from improper sanitization of the recovery ID during a key recovery request, enabling an authenticated user to be tricked into executing crafted JavaScript. MiracleLinux...

CVE-2020-1721

A flaw was found in the Key Recovery Authority KRA Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting XSS vulnerability. An attacker could trick an authenticated victim into executing...

EulerOS 2.0 SP3 : pki-core (EulerOS-SA-2021-1831)

According to the versions of the pki-core packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corresponding certificate ov...

Amazon Linux 2 : pki-core (ALAS-2021-1630)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2021-1630 advisory. A Reflected Cross Site Scripting flaw was found in the pki-ca module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could...

Vault’s PKI Engine CRL May Exclude Revoked But Unexpired Certificates After Tidy

Summary Vault and Vault Enterprise “Vault” PKI Secrets Engine tidy functionality may cause Vault to exclude revoked-but-unexpired certificates from the Vault CRL. This vulnerability, CVE-2021-29653, was fixed in Vault and Vault Enterprise 1.5.8, 1.6.4, and 1.7.1. Background The Vault PKI Secrets...

Important: pki-core

Issue Overview: A Reflected Cross Site Scripting flaw was found in the pki-ca module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim's browser...

pki-core: XSS in the certificate search results

A flaw was found in pki-core. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting XSS attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity...

Important: Red Hat Security Advisory: pki-core:10.6 security and bug fix update

An update for the pki-core:10.6 module is now available for Red Hat Enterprise Linux 8.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating,...

RHEL 8 : pki-core:10.6 (RHSA-2021:1263)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:1263 advisory. The Public Key Infrastructure PKI Core contains fundamental packages required by Red Hat Certificate System. Security Fixes: pki-core:...

pki-core:10.6 security update

pki-core 10.9.4-3.0.1 - Remove redhat reference. 10.9.4-3 - Bug 1933146 - PKI instance creation failed with new 389-ds-base build 10.9.4-2 - CVE-2021-20179: Fix unprivileged users can renew any certificate...

Oracle Linux 8 : pki-core:10.6 (ELSA-2021-0966)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0966 advisory. pki-core 10.9.4-3.0.1 - Remove redhat reference. 10.9.4-3 - Bug 1933146 - PKI instance creation failed with new 389-ds-base build 10.9.4-2 - CVE-2021-20179: Fix...