Red Hat Security Advisory

RHSA-2023:3394

pki-core:10.6 security update

Released 2023-05-31 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream EUS (v.8.6) jss-4.9.3-1.module+el8.6.0+14244+60d461b7.aarch64::pki-core:10.6, jss-4.9.3-1.module+el8.6.0+14244+60d461b7.ppc64le::pki-core:10.6, jss-4.9.3-1.module+el8.6.0+14244+60d461b7.s390x::pki-core:10.6 +27

TI-2022-02229 CVE-2022-2414 · GHSA-vjf8-hc3f-mpw4

HIGH 74

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.85393 Published 2022-07-29 Partial fix CWE-611

TI-2022-02209 CVE-2022-2393 · GHSA-hjh3-jq28-5qcc

LOW 25

A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled.

CVSS 3.1MEDIUM 5.7 Adjacent network Low privileges No interaction EPSS 0.00251 Published 2022-07-14 Partial fix CWE-285