In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade pki-servlet-4.0-apiUpgrade jakarta-commons-httpclientUpgrade apache-commons-netUpgrade xsomUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-providersUpgrade slf4jUpgrade python3-nssUpgrade javassistUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade apache-commons-collectionsUpgrade jackson-jaxrs-json-providerUpgrade xerces-j2Upgrade xalan-j2Upgrade pki-servlet-engineUpgrade glassfish-jaxb-txw2Upgrade glassfish-jaxb-runtimeUpgrade apache-commons-langUpgrade jackson-module-jaxb-annotationsUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade javassist-javadocUpgrade resteasyUpgrade jackson-annotationsUpgrade xml-commons-apisUpgrade stax-exUpgrade glassfish-fastinfosetUpgrade xml-commons-resolverUpgrade jackson-databindUpgrade xmlstreambufferUpgrade jackson-coreUpgrade bea-stax-api | May 4, 2022 | Jul 14, 2020 |
| Centos_linux | — | Upgrade velocityUpgrade xmlstreambufferUpgrade jackson-annotationsUpgrade jackson-module-jaxb-annotationsUpgrade stax-exUpgrade xerces-j2Upgrade xalan-j2Upgrade resteasyUpgrade pki-base-javaUpgrade jss-javadocUpgrade apache-commons-langUpgrade bea-stax-apiUpgrade javassistUpgrade ldapjdkUpgrade xml-commons-apisUpgrade jackson-jaxrs-json-providerUpgrade glassfish-fastinfosetUpgrade pki-symkey-debuginfoUpgrade jackson-databindUpgrade ldapjdk-javadocUpgrade javassist-javadocUpgrade pki-kraUpgrade jakarta-commons-httpclientUpgrade python3-pkiUpgrade tomcatjssUpgrade glassfish-jaxb-coreUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade pki-tools-debuginfoUpgrade pki-baseUpgrade pki-serverUpgrade xml-commons-resolverUpgrade python3-nssUpgrade pki-servlet-4.0-apiUpgrade jackson-jaxrs-providersUpgrade xsomUpgrade pki-toolsUpgrade glassfish-jaxb-runtimeUpgrade pki-core-debugsourceUpgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade relaxngDatatypeUpgrade apache-commons-netUpgrade pki-core-debuginfoUpgrade jss-debugsourceUpgrade pki-symkeyUpgrade jssUpgrade jackson-coreUpgrade apache-commons-collectionsUpgrade python-nss-docUpgrade jss-debuginfoUpgrade pki-caUpgrade slf4j-jdk14Upgrade glassfish-jaxb-txw2Upgrade slf4j | Nov 5, 2020 | Jul 14, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Jul 14, 2020 |
| Oracle_linux | — | Upgrade xsomUpgrade glassfish-jaxb-runtimeUpgrade apache-commons-collectionsUpgrade javassist-javadocUpgrade pki-toolsUpgrade xerces-j2Upgrade resteasyUpgrade glassfish-fastinfosetUpgrade pki-baseUpgrade pki-serverUpgrade tomcatjssUpgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade apache-commons-langUpgrade pki-base-javaUpgrade jss-javadocUpgrade glassfish-jaxb-coreUpgrade jackson-jaxrs-json-providerUpgrade jackson-databindUpgrade glassfish-jaxb-txw2Upgrade jssUpgrade xml-commons-resolverUpgrade apache-commons-netUpgrade slf4jUpgrade pki-caUpgrade relaxngDatatypeUpgrade jackson-coreUpgrade xalan-j2Upgrade jackson-annotationsUpgrade pki-servlet-4.0-apiUpgrade ldapjdk-javadocUpgrade pki-kraUpgrade python-nss-docUpgrade slf4j-jdk14Upgrade ldapjdkUpgrade jackson-jaxrs-providersUpgrade velocityUpgrade python3-pkiUpgrade pki-servlet-engineUpgrade jakarta-commons-httpclientUpgrade bea-stax-apiUpgrade python3-nssUpgrade javassistUpgrade pki-symkeyUpgrade stax-exUpgrade xml-commons-apisUpgrade glassfish-jaxb-api | Jul 22, 2024 | Jun 23, 2020 |
| Redhat_linux | — | Upgrade xml-commons-resolverUpgrade relaxngDatatypeUpgrade jackson-databindUpgrade pki-kraUpgrade jackson-jaxrs-json-providerUpgrade glassfish-jaxb-runtimeUpgrade xerces-j2Upgrade apache-commons-netUpgrade jackson-jaxrs-providersUpgrade jackson-module-jaxb-annotationsUpgrade xmlstreambufferUpgrade jackson-coreUpgrade glassfish-jaxb-txw2Upgrade tomcatjssUpgrade apache-commons-langUpgrade pki-caUpgrade pki-serverUpgrade resteasyUpgrade slf4j-jdk14Upgrade ldapjdkUpgrade xsomUpgrade jackson-annotationsUpgrade jss-javadocUpgrade xml-commons-apisUpgrade pki-servlet-4.0-apiUpgrade pki-core-debugsourceUpgrade python3-pkiUpgrade pki-core-debuginfoUpgrade bea-stax-apiUpgrade pki-tools-debuginfoUpgrade pki-baseUpgrade glassfish-jaxb-apiUpgrade pki-base-javaUpgrade glassfish-jaxb-coreUpgrade jss-debuginfoUpgrade python3-nss-debuginfoUpgrade jssUpgrade xalan-j2Upgrade stax-exUpgrade javassistUpgrade python-nss-docNo solution existsUpgrade jss-debugsourceUpgrade javassist-javadocUpgrade python-nss-debugsourceUpgrade apache-commons-collectionsUpgrade pki-servlet-engineUpgrade pki-toolsUpgrade pki-symkeyUpgrade velocityUpgrade jakarta-commons-httpclientUpgrade ldapjdk-javadocUpgrade glassfish-fastinfosetUpgrade slf4jUpgrade python3-nssUpgrade pki-symkey-debuginfo | Nov 5, 2020 | Jul 14, 2020 |
| Rocky_linux | — | Upgrade python3-nss-debuginfoUpgrade python-nss-debugsourceUpgrade python-nss-docUpgrade python3-nss | Mar 12, 2024 | Jul 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub