Red Hat Security Advisory

RHSA-2019:3225

jss security update

Released 2019-10-29 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux ComputeNode EUS (v. 7.6) jss-4.4.4-6.el7_6
Red Hat Enterprise Linux ComputeNode Optional EUS (v. 7.6) jss-javadoc-4.4.4-6.el7_6
Red Hat Enterprise Linux Server EUS (v. 7.6) jss-4.4.4-6.el7_6
Red Hat Enterprise Linux Server Optional EUS (v. 7.6) jss-javadoc-4.4.4-6.el7_6
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server (v. 7) jss-4.4.4-6.el7_6
Red Hat Enterprise Linux for ARM and IBM Power LE (POWER9) Server Optional (v. 7) jss-javadoc-4.4.4-6.el7_6

Fixes 1 record

TI-2019-11028 CVE-2019-14823 · GHSA-45q2-f3rm-5r6v

Improper certificate validation in Dogtag JSS

LOW 34

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain.

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00859 Published 2019-10-14 Fixed CWE-358