Red Hat Security Advisory: pki-core security and bug fix update

Fixed packages 40

Vulnerabilities 7

• Medium 6.9
  CVE-2020-11023 Exploited Public exploit EPSS 85%

  Potential XSS vulnerability in jQuery

  In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

  jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems
  Apr 29, 2020

  KEV Jan 23, 2025
• Medium 4.7
  CVE-2019-10146

  A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to …

  Red Hat pki-core dogtag-pki dogtag-pki Debian Ubuntu
  Mar 18, 2020
• Medium 4.3
  CVE-2019-10179

  A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not…

  [UNKNOWN] pki-core/pki-kra dogtag-pki dogtag-pki Debian Ubuntu
  Mar 20, 2020
• Medium 4.3
  CVE-2019-10221

  A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from …

  [UNKNOWN] pki-core dogtag-pki dogtag-pki Debian Ubuntu
  Mar 20, 2020
• Unscored —
  CVE-2020-1721

  A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly saniti…

  dogtag-pki dogtag-pki Debian Ubuntu
  Apr 30, 2021
• Unscored —
  CVE-2020-25715

  A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scr…

  dogtag-pki dogtag-pki Debian Ubuntu
  May 28, 2021
• Unscored —
  CVE-2021-20179

  A flaw was found in pki-core. An attacker who has successfully compromised a key could use this flaw to renew the corre…

  dogtag-pki dogtag-pki Debian Ubuntu
  Mar 15, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1695901
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1710171
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1732565
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1777579
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1883639
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1891016
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1914379
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0851.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10146
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10146
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10146
• report
  https://access.redhat.com/security/cve/CVE-2019-10179
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10179
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10179
• report
  https://access.redhat.com/security/cve/CVE-2019-10221
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10221
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10221
• report
  https://access.redhat.com/security/cve/CVE-2020-1721
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-1721
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-1721
• report
  https://access.redhat.com/security/cve/CVE-2020-11023
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1850004
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-11023
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-11023
• article
  https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2020-25715
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25715
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25715
• report
  https://access.redhat.com/security/cve/CVE-2021-20179
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-20179
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-20179