Summary
[10.5.18-23]
- ##########################################################################
- # RHEL 7.9 (Batch Update 18):
- ##########################################################################
- Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
- Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
caServerKeygen_DirUserCert profile, user can get certificates for other
UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
- ##########################################################################
- # RHCS 9.7 (Batch Update 18):
- ##########################################################################
- Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
entities when parsing XML can lead to XXE [certificate_system_9.7.z]
(ckelley, mharmsen)
- Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
caServerKeygen_DirUserCert profile, user can get certificates for other
UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)
[10.5.18-22]
- ##########################################################################
- # RHEL 7.9 (Batch Update 17):
- ##########################################################################
- Bugzilla Bug #2107329 - CVE-2022-2414 pki-core: access to external
entities when parsing XML can lead to XXE [rhel-7.9.z] (ckelley, mharmsen)
- Bugzilla Bug #2111514 - CVE-2022-2393 pki-core: When using the
caServerKeygen_DirUserCert profile, user can get certificates for other
UIDs by entering name in Subject field [rhel-7.9] (cfu, ckelley)
- ##########################################################################
- # RHCS 9.7 (Batch Update 17):
- ##########################################################################
- Bugzilla Bug #2107325 - CVE-2022-2414 pki-core: access to external
entities when parsing XML can lead to XXE [certificate_system_9.7.z]
(ckelley, mharmsen)
- Bugzilla Bug #2111493 - CVE-2022-2393 pki-core: When using the
caServerKeygen_DirUserCert profile, user can get certificates for other
UIDs by entering name in Subject field [rhcs_9.7] (cfu, ckelley)
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | pki-base | 0:10.5.18-23.el7_9 |
| Oracle Linux · 7 | pki-base-java | 0:10.5.18-23.el7_9 |
| Oracle Linux · 7 | pki-ca | 0:10.5.18-23.el7_9 |
| Oracle Linux · 7 | pki-javadoc | 0:10.5.18-23.el7_9 |
| Oracle Linux · 7 | pki-kra | 0:10.5.18-23.el7_9 |
| Oracle Linux · 7 | pki-server | 0:10.5.18-23.el7_9 |
| Oracle Linux · 7 | pki-symkey | 0:10.5.18-23.el7_9 |
| Oracle Linux · 7 | pki-tools | 0:10.5.18-23.el7_9 |
Vulnerabilities 1
-
Unscored —
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-ba…