Red Hat Security Advisory

RHSA-2021:0947

pki-core and redhat-pki-theme security and bug fix update

Released 2021-03-22 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Certificate System 9.7 for Red Hat Enterprise Server 7 pki-core-10.5.18-12.el7pki, pki-ocsp-10.5.18-12.el7pki, pki-tks-10.5.18-12.el7pki +4

Fixes 3 records

TI-2019-07499 CVE-2019-10178 · GHSA-49c6-93gp-7jrp

Cross-site scripting in pki-core

LOW 29

It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0098 Published 2020-03-18 Partial fix CWE-79

TI-2020-01643 CVE-2020-1696 · GHSA-59m3-5f56-55x8

Cross-site scripting in [UNKNOWN] pki-core

LOW 26

A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00764 Published 2020-03-20 Partial fix CWE-79

TI-2019-07501 CVE-2019-10180 · GHSA-3r6g-5p5v-m39h

Cross-site scripting in [UNKNOWN] pki-core

LOW 23

A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00734 Published 2020-03-31 Partial fix CWE-79