The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade apache-commons-netUpgrade glassfish-fastinfosetUpgrade jackson-coreUpgrade pki-servlet-4.0-apiUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade resteasyUpgrade xsomUpgrade jackson-jaxrs-json-providerUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade xalan-j2Upgrade pki-servlet-engineUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade python3-nssUpgrade stax-exUpgrade xml-commons-resolverUpgrade bea-stax-apiUpgrade xerces-j2Upgrade xmlstreambufferUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-runtimeUpgrade velocityUpgrade apache-commons-collectionsUpgrade slf4j-jdk14Upgrade python-nss-docUpgrade javassist-javadocUpgrade jakarta-commons-httpclientUpgrade javassist | May 4, 2022 | Mar 20, 2020 |
| Amazon Linux Ami 2 | — | Upgrade pki-baseUpgrade pki-symkeyUpgrade pki-caUpgrade pki-toolsUpgrade pki-core-debuginfoUpgrade pki-serverUpgrade pki-kraUpgrade pki-javadocUpgrade pki-base-java | Apr 23, 2021 | Mar 20, 2020 |
| Centos_linux | — | Upgrade jackson-databindUpgrade stax-exUpgrade pki-javadocUpgrade xml-commons-apisUpgrade jssUpgrade glassfish-jaxb-apiUpgrade python-nss-docUpgrade jss-debuginfoUpgrade pki-servlet-engineUpgrade pki-kraUpgrade ldapjdkUpgrade jackson-jaxrs-providersUpgrade velocityUpgrade bea-stax-apiUpgrade python3-nssUpgrade slf4j-jdk14Upgrade pki-tools-debuginfoUpgrade pki-symkeyUpgrade pki-symkey-debuginfoUpgrade xerces-j2Upgrade apache-commons-collectionsUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade xsomUpgrade pki-toolsUpgrade apache-commons-netUpgrade pki-caUpgrade pki-base-javaUpgrade pki-serverUpgrade relaxngDatatypeUpgrade jackson-annotationsUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade javassistUpgrade apache-commons-langUpgrade ldapjdk-javadocUpgrade glassfish-jaxb-txw2Upgrade jackson-module-jaxb-annotationsUpgrade jakarta-commons-httpclientUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-runtimeUpgrade javassist-javadocUpgrade resteasyUpgrade slf4jUpgrade xmlstreambufferUpgrade python3-pkiUpgrade xalan-j2Upgrade pki-baseUpgrade tomcatjssUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-coreUpgrade pki-core-debugsourceUpgrade pki-core-debuginfoUpgrade jss-debugsourceUpgrade jss-javadoc | Nov 5, 2020 | Mar 20, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade pki-serverUpgrade pki-caUpgrade pki-toolsUpgrade pki-baseUpgrade pki-kraUpgrade pki-symkey | Feb 22, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade pki-base-javaUpgrade pki-serverUpgrade pki-toolsUpgrade pki-caUpgrade pki-kraUpgrade pki-baseUpgrade pki-symkey | Apr 30, 2021 | Mar 20, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade pki-base-javaUpgrade pki-serverUpgrade pki-baseUpgrade pki-kraUpgrade pki-toolsUpgrade pki-caUpgrade pki-symkey | Dec 16, 2020 | Mar 20, 2020 |
| Oracle_linux | — | Upgrade python3-nssUpgrade bea-stax-apiUpgrade xerces-j2Upgrade jackson-jaxrs-json-providerUpgrade slf4j-jdk14Upgrade pki-symkeyUpgrade pki-baseUpgrade velocityUpgrade python3-pkiUpgrade jackson-coreUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade xml-commons-resolverUpgrade jackson-jaxrs-providersUpgrade ldapjdkUpgrade glassfish-jaxb-runtimeUpgrade python-nss-docUpgrade stax-exUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-coreUpgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade pki-servlet-engineUpgrade pki-caUpgrade resteasyUpgrade pki-serverUpgrade pki-toolsUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade javassistUpgrade xsomUpgrade ldapjdk-javadocUpgrade slf4jUpgrade xml-commons-apisUpgrade glassfish-fastinfosetUpgrade xalan-j2Upgrade jss-javadocUpgrade apache-commons-netUpgrade pki-javadocUpgrade jssUpgrade tomcatjssUpgrade pki-base-javaUpgrade relaxngDatatypeUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade apache-commons-langUpgrade javassist-javadocUpgrade pki-servlet-4.0-api | Mar 18, 2021 | Feb 3, 2020 |
| Redhat_linux | — | Upgrade pki-caUpgrade glassfish-jaxb-runtimeUpgrade glassfish-jaxb-txw2Upgrade pki-serverUpgrade jss-debuginfoUpgrade pki-toolsUpgrade python3-nssUpgrade jackson-databindUpgrade pki-servlet-4.0-apiUpgrade jssUpgrade slf4jUpgrade pki-baseUpgrade pki-symkeyUpgrade python-nss-docUpgrade xsomUpgrade xalan-j2Upgrade xml-commons-resolverUpgrade xml-commons-apisUpgrade xmlstreambufferUpgrade relaxngDatatypeUpgrade pki-kraUpgrade jackson-jaxrs-json-providerUpgrade python-nss-debugsourceUpgrade xerces-j2Upgrade javassist-javadocUpgrade apache-commons-netUpgrade jss-debugsourceUpgrade jackson-annotationsUpgrade jackson-coreUpgrade pki-core-debuginfoUpgrade pki-core-debugsourceUpgrade python3-nss-debuginfoUpgrade python3-pkiUpgrade stax-exUpgrade tomcatjssUpgrade pki-javadocUpgrade velocityUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade glassfish-jaxb-apiUpgrade apache-commons-collectionsUpgrade bea-stax-apiUpgrade pki-base-javaUpgrade glassfish-fastinfosetUpgrade pki-symkey-debuginfoUpgrade javassistUpgrade slf4j-jdk14Upgrade resteasyUpgrade pki-servlet-engineUpgrade glassfish-jaxb-coreUpgrade jakarta-commons-httpclientUpgrade ldapjdkUpgrade ldapjdk-javadocUpgrade jss-javadocUpgrade pki-tools-debuginfoUpgrade jackson-jaxrs-providers | Nov 5, 2020 | Mar 20, 2020 |
| Rocky_linux | — | Upgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nssUpgrade python3-nss-debuginfo | Mar 12, 2024 | Mar 20, 2020 |
| Ubuntu | — | No solution exists | Jun 26, 2025 | Mar 20, 2020 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub