Red Hat Security AdvisoryRHSA-2019:3067
jss security update
Released 2019-10-16 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) jss-4.4.6-3.el7_7
- Red Hat Enterprise Linux Client Optional (v. 7) jss-javadoc-4.4.6-3.el7_7
- Red Hat Enterprise Linux ComputeNode (v. 7) jss-4.4.6-3.el7_7
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) jss-javadoc-4.4.6-3.el7_7
- Red Hat Enterprise Linux Server (v. 7) jss-4.4.6-3.el7_7
- Red Hat Enterprise Linux Server Optional (v. 7) jss-javadoc-4.4.6-3.el7_7
- Red Hat Enterprise Linux Workstation (v. 7) jss-4.4.6-3.el7_7
- Red Hat Enterprise Linux Workstation Optional (v. 7) jss-javadoc-4.4.6-3.el7_7
Fixes 1 record
Priority LOW 34
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.00859 · Published 2019-10-14 · Fixed CWE-358
