In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation. Since the verify parameter was hard-coded in all request functions, it was not possible to override the setting. As a result, tools making use of this class, such as the pki-server command, may have been vulnerable to Person-in-the-Middle attacks in certain non-localhost use cases. This is fixed in 10.9.0-b1.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python-nss-docUpgrade javassistUpgrade slf4j-jdk14Upgrade slf4jUpgrade xsomUpgrade jackson-jaxrs-providersUpgrade apache-commons-netUpgrade pki-servlet-4.0-apiUpgrade glassfish-jaxb-coreUpgrade resteasyUpgrade jakarta-commons-httpclientUpgrade xalan-j2Upgrade bea-stax-apiUpgrade xmlstreambufferUpgrade apache-commons-langUpgrade glassfish-jaxb-txw2Upgrade xml-commons-resolverUpgrade javassist-javadocUpgrade apache-commons-collectionsUpgrade glassfish-jaxb-runtimeUpgrade jackson-module-jaxb-annotationsUpgrade glassfish-jaxb-apiUpgrade velocityUpgrade jackson-jaxrs-json-providerUpgrade jackson-coreUpgrade jackson-annotationsUpgrade pki-servlet-engineUpgrade glassfish-fastinfosetUpgrade stax-exUpgrade xml-commons-apisUpgrade jackson-databindUpgrade python3-nssUpgrade xerces-j2 | May 4, 2022 | Jul 14, 2020 |
| Centos_linux | — | Upgrade xmlstreambufferUpgrade jackson-module-jaxb-annotationsUpgrade jackson-annotationsUpgrade xerces-j2Upgrade stax-exUpgrade glassfish-jaxb-apiUpgrade python3-pkiUpgrade glassfish-jaxb-coreUpgrade pki-baseUpgrade jackson-databindUpgrade resteasyUpgrade ldapjdkUpgrade pki-base-javaUpgrade pki-serverUpgrade xalan-j2Upgrade pki-symkey-debuginfoUpgrade jackson-jaxrs-json-providerUpgrade ldapjdk-javadocUpgrade tomcatjssUpgrade velocityUpgrade pki-servlet-engineUpgrade pki-kraUpgrade javassistUpgrade jakarta-commons-httpclientUpgrade javassist-javadocUpgrade pki-tools-debuginfoUpgrade jss-javadocUpgrade xml-commons-apisUpgrade apache-commons-langUpgrade glassfish-fastinfosetUpgrade bea-stax-apiUpgrade pki-toolsUpgrade python-nss-docUpgrade xml-commons-resolverUpgrade jssUpgrade jss-debugsourceUpgrade relaxngDatatypeUpgrade slf4j-jdk14Upgrade glassfish-jaxb-runtimeUpgrade slf4jUpgrade glassfish-jaxb-txw2Upgrade python3-nssUpgrade jss-debuginfoUpgrade xsomUpgrade pki-servlet-4.0-apiUpgrade pki-caUpgrade python3-nss-debuginfoUpgrade pki-core-debugsourceUpgrade python-nss-debugsourceUpgrade jackson-jaxrs-providersUpgrade apache-commons-netUpgrade pki-core-debuginfoUpgrade pki-symkeyUpgrade apache-commons-collectionsUpgrade jackson-core | Nov 5, 2020 | Jul 14, 2020 |
| Debian | — | Upgrade dogtag-pki | Jul 30, 2024 | Jul 14, 2020 |
| Oracle_linux | — | Upgrade velocityUpgrade glassfish-jaxb-apiUpgrade pki-kraUpgrade jackson-jaxrs-providersUpgrade python3-nssUpgrade python-nss-docUpgrade stax-exUpgrade javassistUpgrade slf4j-jdk14Upgrade ldapjdkUpgrade pki-symkeyUpgrade xml-commons-apisUpgrade ldapjdk-javadocUpgrade pki-servlet-engineUpgrade jakarta-commons-httpclientUpgrade python3-pkiUpgrade bea-stax-apiUpgrade pki-baseUpgrade apache-commons-langUpgrade jss-javadocUpgrade pki-servlet-4.0-apiUpgrade jackson-databindUpgrade javassist-javadocUpgrade jackson-module-jaxb-annotationsUpgrade jackson-jaxrs-json-providerUpgrade apache-commons-netUpgrade glassfish-jaxb-runtimeUpgrade resteasyUpgrade apache-commons-collectionsUpgrade xsomUpgrade jackson-coreUpgrade glassfish-jaxb-coreUpgrade slf4jUpgrade jackson-annotationsUpgrade relaxngDatatypeUpgrade glassfish-fastinfosetUpgrade pki-serverUpgrade xml-commons-resolverUpgrade xmlstreambufferUpgrade xerces-j2Upgrade pki-base-javaUpgrade pki-caUpgrade glassfish-jaxb-txw2Upgrade jssUpgrade pki-toolsUpgrade tomcatjssUpgrade xalan-j2 | Jul 22, 2024 | Jun 23, 2020 |
| Redhat_linux | — | Upgrade stax-exUpgrade xalan-j2Upgrade glassfish-jaxb-coreUpgrade python-nss-docNo solution existsUpgrade ldapjdk-javadocUpgrade python3-nssUpgrade apache-commons-collectionsUpgrade pki-symkeyUpgrade pki-symkey-debuginfoUpgrade python3-nss-debuginfoUpgrade jss-debugsourceUpgrade jss-debuginfoUpgrade jssUpgrade glassfish-fastinfosetUpgrade velocityUpgrade glassfish-jaxb-apiUpgrade pki-servlet-engineUpgrade javassist-javadocUpgrade python-nss-debugsourceUpgrade javassistUpgrade pki-base-javaUpgrade pki-toolsUpgrade slf4jUpgrade jakarta-commons-httpclientUpgrade pki-core-debuginfoUpgrade glassfish-jaxb-txw2Upgrade pki-serverUpgrade xmlstreambufferUpgrade pki-servlet-4.0-apiUpgrade xsomUpgrade relaxngDatatypeUpgrade xml-commons-resolverUpgrade glassfish-jaxb-runtimeUpgrade jackson-databindUpgrade pki-kraUpgrade python3-pkiUpgrade jackson-annotationsUpgrade jackson-coreUpgrade pki-tools-debuginfoUpgrade tomcatjssUpgrade apache-commons-langUpgrade pki-caUpgrade pki-core-debugsourceUpgrade jackson-module-jaxb-annotationsUpgrade xml-commons-apisUpgrade jackson-jaxrs-providersUpgrade slf4j-jdk14Upgrade bea-stax-apiUpgrade ldapjdkUpgrade pki-baseUpgrade jss-javadocUpgrade apache-commons-netUpgrade xerces-j2Upgrade resteasyUpgrade jackson-jaxrs-json-provider | Nov 5, 2020 | Jul 14, 2020 |
| Rocky_linux | — | Upgrade python-nss-docUpgrade python-nss-debugsourceUpgrade python3-nssUpgrade python3-nss-debuginfo | Mar 12, 2024 | Jul 14, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub