In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade jackson-coreUpgrade jackson-annotationsUpgrade javassist-javadocUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-apiUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade xml-commons-apisUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade resteasyUpgrade stax-exUpgrade pki-servlet-engineUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-resolverUpgrade velocityUpgrade bea-stax-apiUpgrade xalan-j2Upgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade jackson-jaxrs-providersUpgrade pki-servlet-4.0-apiUpgrade apache-commons-netUpgrade jakarta-commons-httpclientUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade javassistUpgrade xsomUpgrade slf4jUpgrade glassfish-jaxb-core | May 4, 2022 | Jul 14, 2020 |
| Centos_linux | — | Upgrade pki-toolsUpgrade jss-debuginfoUpgrade slf4jUpgrade glassfish-jaxb-runtimeUpgrade python3-nssUpgrade pki-caUpgrade apache-commons-netUpgrade glassfish-jaxb-txw2Upgrade relaxngDatatypeUpgrade slf4j-jdk14Upgrade pki-core-debugsourceUpgrade python-nss-debugsourceUpgrade jackson-jaxrs-providersUpgrade pki-servlet-4.0-apiUpgrade python3-nss-debuginfoUpgrade xsomUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade apache-commons-collectionsUpgrade jackson-coreUpgrade pki-symkeyUpgrade jss-debugsourceUpgrade jssUpgrade pki-core-debuginfoUpgrade velocityUpgrade xerces-j2Upgrade stax-exUpgrade tomcatjssUpgrade pki-servlet-engineUpgrade jakarta-commons-httpclientUpgrade jackson-annotationsUpgrade jackson-databindUpgrade glassfish-jaxb-apiUpgrade jackson-module-jaxb-annotationsUpgrade python3-pkiUpgrade ldapjdk-javadocUpgrade ldapjdkUpgrade pki-kraUpgrade pki-serverUpgrade xml-commons-apisUpgrade jss-javadocUpgrade apache-commons-langUpgrade xmlstreambufferUpgrade javassistUpgrade pki-tools-debuginfoUpgrade pki-baseUpgrade glassfish-jaxb-coreUpgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade javassist-javadocUpgrade jackson-jaxrs-json-providerUpgrade xalan-j2Upgrade resteasyUpgrade pki-base-javaUpgrade pki-symkey-debuginfo | Nov 5, 2020 | Jul 14, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Jul 14, 2020 |
| Oracle_linux | — | Upgrade javassist-javadocUpgrade jss-javadocUpgrade apache-commons-langUpgrade jackson-jaxrs-json-providerUpgrade resteasyUpgrade relaxngDatatypeUpgrade xml-commons-resolverUpgrade pki-caUpgrade glassfish-fastinfosetUpgrade glassfish-jaxb-txw2Upgrade jssUpgrade pki-baseUpgrade xsomUpgrade pki-serverUpgrade xerces-j2Upgrade glassfish-jaxb-coreUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade xmlstreambufferUpgrade pki-toolsUpgrade slf4jUpgrade jackson-annotationsUpgrade pki-base-javaUpgrade apache-commons-netUpgrade glassfish-jaxb-runtimeUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade jackson-module-jaxb-annotationsUpgrade xalan-j2Upgrade tomcatjssUpgrade ldapjdkUpgrade glassfish-jaxb-apiUpgrade slf4j-jdk14Upgrade velocityUpgrade python-nss-docUpgrade pki-kraUpgrade python3-pkiUpgrade pki-servlet-engineUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade python3-nssUpgrade xml-commons-apisUpgrade pki-symkeyUpgrade javassistUpgrade stax-exUpgrade ldapjdk-javadocUpgrade jackson-jaxrs-providers | Jul 22, 2024 | Jun 23, 2020 |
| Redhat_linux | — | Upgrade glassfish-fastinfosetUpgrade pki-servlet-engineUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade xalan-j2Upgrade ldapjdk-javadocUpgrade jss-debugsourceUpgrade javassistUpgrade slf4jUpgrade pki-symkey-debuginfoUpgrade python3-nss-debuginfoUpgrade pki-base-javaUpgrade glassfish-jaxb-coreUpgrade python-nss-docUpgrade stax-exUpgrade pki-toolsUpgrade velocityNo solution existsUpgrade javassist-javadocUpgrade jss-debuginfoUpgrade pki-symkeyUpgrade jssUpgrade python-nss-debugsourceUpgrade glassfish-jaxb-apiUpgrade jakarta-commons-httpclientUpgrade pki-tools-debuginfoUpgrade tomcatjssUpgrade bea-stax-apiUpgrade pki-servlet-4.0-apiUpgrade jss-javadocUpgrade relaxngDatatypeUpgrade python3-pkiUpgrade xmlstreambufferUpgrade jackson-jaxrs-providersUpgrade pki-kraUpgrade jackson-annotationsUpgrade xerces-j2Upgrade apache-commons-netUpgrade apache-commons-langUpgrade pki-caUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debugsourceUpgrade pki-serverUpgrade pki-core-debuginfoUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade jackson-jaxrs-json-providerUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade ldapjdkUpgrade xml-commons-resolverUpgrade slf4j-jdk14Upgrade xsomUpgrade resteasyUpgrade pki-baseUpgrade jackson-core | Nov 5, 2020 | Jul 14, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-docUpgrade python3-nssUpgrade python-nss-debugsource | Mar 12, 2024 | Jul 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub