Red Hat Security Advisory

RHSA-2021:0851

pki-core security and bug fix update

Released 2021-03-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux Client Optional (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +6
Red Hat Enterprise Linux ComputeNode Optional (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +6
Red Hat Enterprise Linux Server (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +5
Red Hat Enterprise Linux Server Optional (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +6
Red Hat Enterprise Linux Workstation (v. 7) pki-base-10.5.18-12.el7_9, pki-base-java-10.5.18-12.el7_9, pki-ca-10.5.18-12.el7_9 +5
Red Hat Enterprise Linux Workstation Optional (v. 7) pki-javadoc-10.5.18-12.el7_9

Fixes 7 records

TI-2020-08897 CVE-2020-11023 · GHSA-jpcq-cgw6-v4j6

Potential XSS vulnerability in jQuery

CRITICAL 88KEV

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e.

CVSS 3.1MEDIUM 6.9 Network No auth User interaction EPSS 0.84887 Published 2020-04-29 Partial fix · 3.5.0, 4.4.0 CWE-79

TI-2021-03479 CVE-2021-20179 · GHSA-q87w-gh3f-77p7

Incorrect authorization in pki-core

LOW 38

A flaw was found in pki-core.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0122 Published 2021-03-15 Partial fix CWE-863

TI-2020-15729 CVE-2020-25715 · GHSA-cg99-xqcm-67pf

Cross-site scripting in pki-core

LOW 30

A flaw was found in pki-core 10.9.0.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01142 Published 2021-05-28 Partial fix CWE-79

TI-2019-07541 CVE-2019-10221 · GHSA-wfff-rc4w-hpx2

Cross-site scripting in [UNKNOWN] pki-core

LOW 30

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from the pki-core server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01322 Published 2020-03-20 Partial fix CWE-79

TI-2020-01665 CVE-2020-1721 · GHSA-j9fq-77vj-2ww7

Cross-site scripting in pki-core

LOW 29

A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly sanitize the recovery ID during a key recovery request, enabling a reflected cross-site scripting (XSS) vul…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00981 Published 2021-04-30 Fixed CWE-79

TI-2019-07500 CVE-2019-10179 · GHSA-rwmx-694x-q86h

Cross-site scripting in [UNKNOWN] pki-core/pki-kra

LOW 29

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vuln…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00938 Published 2020-03-20 Fixed CWE-79

TI-2019-07469 CVE-2019-10146 · GHSA-9wr3-2hgg-f56c

Cross-site scripting in Red Hat pki-core

LOW 23

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00677 Published 2020-03-18 Fixed CWE-79