Oracle Linux 8 : pki-deps:10.6 (ELSA-2019-1529)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-1529 advisory. - Resolves: rhbz1658846 CVE-2018-8034 pki-servlet-container: tomcat: host name verification missing in WebSocket client - Resolves: rhbz1579614...

NewStart CGSL CORE 5.04 / MAIN 5.04 : pki-core Vulnerability (NS-SA-2019-0063)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has pki-core packages installed that are affected by a vulnerability: - Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny...

pki-deps:10.6 security update

apache-commons-collections 3.2.2-10 - Rebuilt for https://fedoraproject.org/wiki/Fedora29MassRebuild 3.2.2-9 - Remove workaround for symlink-directory rpm bug jackson-bom 2.9.8-1 - Update to latest upstream release 2.9.4-2 - Rebuilt for https://fedoraproject.org/wiki/Fedora28MassRebuild 2.9.4-1 -...

CVE-2019-10072

The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOWUPDATE messages for the connection window stream 0 clients were able to cause server-side threads to...

Important: Red Hat Security Advisory: pki-deps:10.6 security update

An update for the pki-deps:10.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by AlmaLinux Certificate System. Security Fixes: tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up CVE-2018-8037 tomcat: Insecure...

pki-deps:10.6 security update

An update is available for glassfish-jaxb-api, glassfish-fastinfoset, xalan-j2, xmlstreambuffer, apache-commons-lang, jackson-module-jaxb-annotations, apache-commons-collections, javassist, python-nss, bea-stax, velocity, xml-commons-apis, resteasy, xsom, slf4j, stax-ex, xerces-j2,...

ALSA-2019:1529 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by AlmaLinux Certificate System. Security Fixes: tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up CVE-2018-8037 tomcat: Insecure...

RLSA-2019:1529 Important: pki-deps:10.6 security update

The Public Key Infrastructure PKI Deps module contains fundamental packages required as dependencies for the pki-core module by Rocky Enterprise Software Foundation Certificate System. Security Fixes: tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up...

HTTPS client certificate authentication security issues. Part 2/3

In the first story, I described some issues related to client certificates authentication implementations in environments with load balancers. This time I’d like to mention some typical issues in custom certificate validation processes when a developer is doing this itself in application code...

Extinguishing the IoT Insecurity Dumpster Fire

It’s no secret IoT security has been a dumpster fire. Last week, it was reported two million IP security cameras, baby monitors and smart doorbells have serious IoT flaws with no known patches. The list, of course, is added to a long list of IoT nightmares that have been reported over the past fi...

Arbitrary Code Execution

Red Hat Certificate System RHCS is an enterprise software system designed to manage enterprise Public Key Infrastructure PKI deployments. The Token Processing System TPS is a PKI subsystem that acts as a Registration Authority RA for authenticating and processing enrollment requests, PIN reset...

Privilege Escalation

Red Hat Certificate System is an enterprise software system designed to manage enterprise Public Key Infrastructure PKI deployments. Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System Agent and End Entity pages. An attacker could use these flaws to perform a...

Denial Of Service (DoS)

Red Hat Certificate System RHCS is an enterprise software system designed to manage enterprise Public Key Infrastructure PKI deployments. Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System. An attacker could use these flaws to perform a cross-site scripting XSS...

Denial Of Service (DoS)

Red Hat Certificate System RHCS is an enterprise software system designed to manage enterprise Public Key Infrastructure PKI deployments. Multiple cross-site scripting flaws were discovered in the Red Hat Certificate System. An attacker could use these flaws to perform a cross-site scripting XSS...

Security fix for the ALT Linux 8 package pki-core version 10.2.6-alt4_19jpp8.M80P.2

10.2.6-alt419jpp8.M80P.2 built April 1, 2019 Stanislav Levin in task 225227 March 18, 2019 Stanislav Levin - Fixed ACL evaluation in allow,deny mode fixes: CVE-2018-1080. - Fixed Javadoc build. - Fixed intersections with filesystem...

Privilege Escalation

pki-core is vulnerable to privilege escalation attacks. The vulnerability exists as Dogtag PKI, through version 10.6.1, has a vulnerability in AAclAuthz.java that, under certain configurations, causes the application of ACL allow and deny rules to be reversed. If a server is configured to process...

Authentication Bypass

pki-core is vulnerable to authentication bypass attacks. The vulnerability exists as it was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the...

Authorization Bypass

openstack-keystone is vulnerable to authorization bypass attacks. The vulnerability exists as the 1 mamcache and 2 KVS token backends in OpenStack Identity Keystone Folsom 2012.2.x and Grizzly before 2013.1.4 do not properly compare the PKI token revocation list with PKI tokens, which allow remot...

Failure In Verification Of PKI Token Expiry

There is a flaw in python-keystoneclient which does not verify the expiry of PKI tokens. It allows an authenticated user to use a token or even a revoked token after its expiry...