Summary
The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System.
Security Fix(es):
* dogtag ca: token authentication bypass vulnerability (CVE-2023-4727)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Fixed packages 16
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | idm-jss | 4.11.0-1.module_el8.10.0+3801+17b19a60 |
| AlmaLinux · 8 | idm-jss-javadoc | 4.11.0-1.module_el8.10.0+3801+17b19a60 |
| AlmaLinux · 8 | idm-ldapjdk | 4.24.0-1.module_el8.10.0+3801+17b19a60 |
| AlmaLinux · 8 | idm-ldapjdk-javadoc | 4.24.0-1.module_el8.10.0+3801+17b19a60 |
| AlmaLinux · 8 | idm-pki-acme | 10.15.1-1.module_el8.10.0+3868+cdab0fd8 |
| AlmaLinux · 8 | idm-pki-base | 10.15.1-1.module_el8.10.0+3868+cdab0fd8 |
| AlmaLinux · 8 | idm-pki-base-java | 10.15.1-1.module_el8.10.0+3868+cdab0fd8 |
| AlmaLinux · 8 | idm-pki-ca | 10.15.1-1.module_el8.10.0+3868+cdab0fd8 |
| AlmaLinux · 8 | idm-pki-kra | 10.15.1-1.module_el8.10.0+3868+cdab0fd8 |
| AlmaLinux · 8 | idm-pki-server | 10.15.1-1.module_el8.10.0+3868+cdab0fd8 |
| AlmaLinux · 8 | idm-pki-symkey | 10.15.1-1.module_el8.10.0+3868+cdab0fd8 |
| AlmaLinux · 8 | idm-pki-tools | 10.15.1-1.module_el8.10.0+3868+cdab0fd8 |
| AlmaLinux · 8 | idm-tomcatjss | 7.8.0-1.module_el8.10.0+3801+17b19a60 |
| AlmaLinux · 8 | python3-idm-pki | 10.15.1-1.module_el8.10.0+3868+cdab0fd8 |
| AlmaLinux · 8 | resteasy | 3.0.26-7.module_el8.10.0+3808+9d4ab1fb |
| AlmaLinux · 8 | resteasy-javadoc | 3.0.26-7.module_el8.10.0+3808+9d4ab1fb |
Vulnerabilities 1
-
High 7.5
Ca: token authentication bypass vulnerability
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, wh…