A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade resteasyUpgrade idm-tomcatjssUpgrade idm-pki-baseUpgrade resteasy-javadocUpgrade idm-pki-serverUpgrade idm-pki-toolsUpgrade idm-pki-symkeyUpgrade idm-pki-estUpgrade idm-pki-caUpgrade idm-pki-javaUpgrade idm-pki-base-javaUpgrade python3-idm-pkiUpgrade idm-ldapjdkUpgrade idm-ldapjdk-javadocUpgrade idm-pki-acmeUpgrade idm-jss-javadocUpgrade idm-pki-kraUpgrade idm-jss | Jun 28, 2024 | Jun 11, 2024 |
| Amazon Linux Ami 2 | — | Upgrade pki-base-javaUpgrade pki-baseUpgrade pki-core-debuginfoUpgrade pki-javadocUpgrade pki-caUpgrade pki-toolsUpgrade pki-symkeyUpgrade pki-serverUpgrade pki-kra | Jul 12, 2024 | Jun 11, 2024 |
| Debian | — | No solution exists | May 15, 2025 | Jun 11, 2024 |
| Oracle_linux | — | Upgrade pki-baseUpgrade idm-pki-symkeyUpgrade idm-pki-serverUpgrade idm-pki-baseUpgrade idm-pki-caUpgrade pki-serverUpgrade pki-caUpgrade pki-toolsUpgrade idm-pki-estUpgrade idm-tomcatjssUpgrade pki-base-javaUpgrade resteasy-javadocUpgrade idm-jssUpgrade idm-pki-acmeUpgrade idm-pki-javaUpgrade idm-pki-base-javaUpgrade pki-kraUpgrade idm-pki-kraUpgrade pki-javadocUpgrade idm-pki-toolsUpgrade idm-ldapjdk-javadocUpgrade idm-jss-javadocUpgrade idm-ldapjdkUpgrade python3-idm-pkiUpgrade resteasyUpgrade pki-symkey | Jun 28, 2024 | Jun 11, 2024 |
| Redhat_linux | — | Upgrade idm-pki-serverUpgrade idm-pki-tools-debuginfoUpgrade idm-pki-caUpgrade pki-symkeyUpgrade pki-caUpgrade pki-toolsUpgrade idm-pki-javaNo solution existsUpgrade python3-idm-pkiUpgrade pki-core-debuginfoUpgrade idm-pki-estUpgrade pki-base-javaUpgrade pki-kraUpgrade pki-serverUpgrade idm-pki-baseUpgrade pki-core-debugsourceUpgrade idm-pki-toolsUpgrade idm-pki-acmeUpgrade idm-pki-kraUpgrade pki-baseUpgrade pki-javadoc | Jun 26, 2024 | Jun 11, 2024 |
| Rocky_linux | — | Upgrade pki-core-debugsourceUpgrade jss-debugsourceUpgrade idm-pki-tools-debuginfoUpgrade idm-pki-symkey-debuginfoUpgrade pki-core-debuginfoUpgrade idm-jssUpgrade idm-jss-debuginfoUpgrade idm-jss-javadocUpgrade idm-pki-symkeyUpgrade idm-pki-tools | Jul 4, 2024 | Jun 11, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub