RLSA-2020:4847 — Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

Summary

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.

Security Fix(es):

* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)

* bootstrap: XSS in the data-target attribute (CVE-2016-10735)

* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)

* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)

* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)

* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)

* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)

* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)

* pki: Dogtag's python client does not validate certificates (CVE-2020-15720)

* pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page (CVE-2019-10146)

* pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab (CVE-2019-10179)

* pki-core: Reflected XSS in getcookies?url= endpoint in CA (CVE-2019-10221)

* pki-core: KRA vulnerable to reflected XSS via the getPk12 page (CVE-2020-1721)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Rocky Linux 8.3 Release Notes linked from the References section.

Fixed packages 41

Release	Package	Fixed in
Rocky Linux · 8	apache-commons-collections	0:3.2.2-10.module+el8.3.0+53+ea062990
Rocky Linux · 8	apache-commons-collections	0:3.2.2-10.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	apache-commons-lang	0:2.6-21.module+el8.3.0+53+ea062990
Rocky Linux · 8	apache-commons-lang	0:2.6-21.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	apache-commons-net	0:3.6-3.module+el8.3.0+53+ea062990
Rocky Linux · 8	apache-commons-net	0:3.6-3.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	bea-stax	0:1.2.0-16.module+el8.3.0+53+ea062990
Rocky Linux · 8	glassfish-fastinfoset	0:1.2.13-9.module+el8.3.0+53+ea062990
Rocky Linux · 8	glassfish-jaxb	0:2.2.11-11.module+el8.3.0+53+ea062990
Rocky Linux · 8	glassfish-jaxb-api	0:2.2.12-8.module+el8.3.0+53+ea062990
Rocky Linux · 8	jackson-annotations	0:2.10.0-1.module+el8.3.0+53+ea062990
Rocky Linux · 8	jackson-core	0:2.10.0-1.module+el8.3.0+53+ea062990
Rocky Linux · 8	jackson-databind	0:2.10.0-1.module+el8.3.0+53+ea062990
Rocky Linux · 8	jackson-jaxrs-providers	0:2.9.9-1.module+el8.3.0+53+ea062990
Rocky Linux · 8	jackson-module-jaxb-annotations	0:2.7.6-4.module+el8.3.0+53+ea062990
Rocky Linux · 8	jakarta-commons-httpclient	1:3.1-28.module+el8.3.0+53+ea062990
Rocky Linux · 8	jakarta-commons-httpclient	1:3.1-28.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	javassist	0:3.18.1-8.module+el8.3.0+53+ea062990
Rocky Linux · 8	javassist	0:3.18.1-8.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	ldapjdk	0:4.22.0-1.module+el8.4.0+418+b7ae1d4a
Rocky Linux · 8	pki-servlet-engine	1:9.0.30-1.module+el8.3.0+53+ea062990
Rocky Linux · 8	python-nss	0:1.0.1-10.module+el8.3.0+53+ea062990
Rocky Linux · 8	relaxngDatatype	0:2011.1-7.module+el8.3.0+53+ea062990
Rocky Linux · 8	resteasy	0:3.0.26-3.module+el8.3.0+53+ea062990
Rocky Linux · 8	slf4j	0:1.7.25-4.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	slf4j	0:1.7.25-4.module+el8.3.0+133+b8b54b58
Rocky Linux · 8	slf4j	0:1.7.25-4.module+el8.5.0+697+f586bb30
Rocky Linux · 8	stax-ex	0:1.7.7-8.module+el8.3.0+53+ea062990
Rocky Linux · 8	velocity	0:1.7-24.module+el8.3.0+53+ea062990
Rocky Linux · 8	velocity	0:1.7-24.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	xalan-j2	0:2.7.1-38.module+el8.3.0+53+ea062990
Rocky Linux · 8	xalan-j2	0:2.7.1-38.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	xerces-j2	0:2.11.0-34.module+el8.3.0+53+ea062990
Rocky Linux · 8	xerces-j2	0:2.11.0-34.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	xml-commons-apis	0:1.4.01-25.module+el8.5.0+697+f586bb30
Rocky Linux · 8	xml-commons-apis	0:1.4.01-25.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	xml-commons-apis	0:1.4.01-25.module+el8.3.0+53+ea062990
Rocky Linux · 8	xml-commons-resolver	0:1.2-26.module+el8.3.0+53+ea062990
Rocky Linux · 8	xml-commons-resolver	0:1.2-26.module+el8.3.0+74+855e3f5d
Rocky Linux · 8	xmlstreambuffer	0:1.5.4-8.module+el8.3.0+53+ea062990
Rocky Linux · 8	xsom	0:0-19.20110809svn.module+el8.3.0+53+ea062990

Vulnerabilities 17

Critical 9.8

CVE-2020-1938 Exploited Public exploit Scanner template EPSS 99%

Improper Privilege Management in Tomcat

When using the Apache JServ Protocol (AJP), care must be taken when trusting incoming connections to Apache Tomcat. Tomcat treats AJP connections as having higher trust than, for example, a similar HTTP connection. If such connections are available to an atta…

Apache Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven

Feb 24, 2020
KEV Mar 3, 2022
Medium 6.9

CVE-2020-11023 Exploited Public exploit EPSS 85%

Potential XSS vulnerability in jQuery

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems

Apr 29, 2020
KEV Jan 23, 2025
High 8.6

CVE-2022-25762

Response mix-up with WebSocket concurrent send and close

If a web application sends a WebSocket message concurrently with the WebSocket connection closing when running on Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20, it is possible that the application will continue to use the socket after it h…

Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven

May 13, 2022
Medium 6.9

CVE-2020-11022 Public exploit EPSS 99%

jQuery has a potential XSS vulnerability

In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…

jquery jQuery keycloak-26.6-iamguarded-compat drupal7 Debian Ubuntu Alpine Wolfi npm Packagist Maven NuGet RubyGems

Apr 29, 2020
Medium 6.1

CVE-2015-9251 Public exploit EPSS 30%

Cross-Site Scripting (XSS) in jquery

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

ruby ceph jquery-rails org.webjars.npm:jquery Ubuntu Azure Linux Alpine npm Maven NuGet RubyGems

Jan 18, 2018
Medium 6.1

CVE-2016-10735 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.

bootstrap twitter-bootstrap3 twitter-bootstrap3 twbs/bootstrap Debian Ubuntu npm Packagist Maven NuGet RubyGems

Jan 9, 2019
Medium 6.1

CVE-2018-14040 Public exploit

Bootstrap vulnerable to Cross-Site Scripting (XSS)

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

reaper twitter-bootstrap3 bootstrap twitter-bootstrap3 Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2018-14042 Public exploit

Bootstrap Cross-site Scripting vulnerability

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

ceph fluent-bit pytorch bootstrap Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Jul 13, 2018
Medium 6.1

CVE-2019-11358 Public exploit EPSS 87%

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…

mediawiki mediawiki django drupal/core Debian Ubuntu Azure Linux Alpine npm Packagist Maven PyPI NuGet RubyGems

Apr 19, 2019
Medium 6.1

CVE-2019-8331 Public exploit EPSS 16%

Bootstrap Vulnerable to Cross-Site Scripting

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

ceph fluent-bit pytorch ntopng Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems

Feb 20, 2019
Medium 4.8

CVE-2020-1935

Potential HTTP request smuggling in Apache Tomcat

In Apache Tomcat 9.0.0.M1 to 9.0.30, 8.5.0 to 8.5.50 and 7.0.0 to 7.0.99 the HTTP header parsing code used an approach to end-of-line parsing that allowed some invalid HTTP headers to be parsed as valid. This led to a possibility of HTTP Request Smuggling if …

Apache Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven

Feb 24, 2020
Medium 4.7

CVE-2019-10146

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to …

Red Hat pki-core dogtag-pki dogtag-pki Debian Ubuntu

Mar 18, 2020
Medium 4.3

CVE-2019-10179

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not…

[UNKNOWN] pki-core/pki-kra dogtag-pki dogtag-pki Debian Ubuntu

Mar 20, 2020
Medium 4.3

CVE-2019-10221

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from …

[UNKNOWN] pki-core dogtag-pki dogtag-pki Debian Ubuntu

Mar 20, 2020
Unscored —

CVE-2020-15720

In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation.…

dogtag-pki dogtag-pki Debian Ubuntu

Jul 14, 2020
Unscored —

CVE-2020-1721

A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly saniti…

dogtag-pki dogtag-pki Debian Ubuntu

Apr 30, 2021
Unscored —

CVE-2020-25715

A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scr…

dogtag-pki dogtag-pki Debian Ubuntu

May 28, 2021

References

report
https://bugzilla.redhat.com/show_bug.cgi?id=1376706
report
https://bugzilla.redhat.com/show_bug.cgi?id=1399546
report
https://bugzilla.redhat.com/show_bug.cgi?id=1406505
report
https://bugzilla.redhat.com/show_bug.cgi?id=1601614
report
https://bugzilla.redhat.com/show_bug.cgi?id=1601617
report
https://bugzilla.redhat.com/show_bug.cgi?id=1666907
report
https://bugzilla.redhat.com/show_bug.cgi?id=1668097
report
https://bugzilla.redhat.com/show_bug.cgi?id=1686454
report
https://bugzilla.redhat.com/show_bug.cgi?id=1695901
report
https://bugzilla.redhat.com/show_bug.cgi?id=1701972
report
https://bugzilla.redhat.com/show_bug.cgi?id=1706521
report
https://bugzilla.redhat.com/show_bug.cgi?id=1710171
report
https://bugzilla.redhat.com/show_bug.cgi?id=1721684
report
https://bugzilla.redhat.com/show_bug.cgi?id=1724433
report
https://bugzilla.redhat.com/show_bug.cgi?id=1732565
report
https://bugzilla.redhat.com/show_bug.cgi?id=1732981
report
https://bugzilla.redhat.com/show_bug.cgi?id=1777579
report
https://bugzilla.redhat.com/show_bug.cgi?id=1805541
report
https://bugzilla.redhat.com/show_bug.cgi?id=1817247
report
https://bugzilla.redhat.com/show_bug.cgi?id=1821851
report
https://bugzilla.redhat.com/show_bug.cgi?id=1822246
report
https://bugzilla.redhat.com/show_bug.cgi?id=1824939
report
https://bugzilla.redhat.com/show_bug.cgi?id=1824948
report
https://bugzilla.redhat.com/show_bug.cgi?id=1825998
report
https://bugzilla.redhat.com/show_bug.cgi?id=1828406
report
https://bugzilla.redhat.com/show_bug.cgi?id=1842734
report
https://bugzilla.redhat.com/show_bug.cgi?id=1842736
report
https://bugzilla.redhat.com/show_bug.cgi?id=1843537
report
https://bugzilla.redhat.com/show_bug.cgi?id=1845447
report
https://bugzilla.redhat.com/show_bug.cgi?id=1850004
report
https://bugzilla.redhat.com/show_bug.cgi?id=1854043
report
https://bugzilla.redhat.com/show_bug.cgi?id=1854959
report
https://bugzilla.redhat.com/show_bug.cgi?id=1855273
report
https://bugzilla.redhat.com/show_bug.cgi?id=1855319
report
https://bugzilla.redhat.com/show_bug.cgi?id=1856368
report
https://bugzilla.redhat.com/show_bug.cgi?id=1857933
report
https://bugzilla.redhat.com/show_bug.cgi?id=1861911
report
https://bugzilla.redhat.com/show_bug.cgi?id=1869893
report
https://bugzilla.redhat.com/show_bug.cgi?id=1871064

Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

Summary

Fixed packages 41

Vulnerabilities 17

Improper Privilege Management in Tomcat

Potential XSS vulnerability in jQuery

Response mix-up with WebSocket concurrent send and close

jQuery has a potential XSS vulnerability

Cross-Site Scripting (XSS) in jquery

Bootstrap Cross-site Scripting vulnerability

Bootstrap vulnerable to Cross-Site Scripting (XSS)

Bootstrap Cross-site Scripting vulnerability

XSS in jQuery as used in Drupal, Backdrop CMS, and other products

Bootstrap Vulnerable to Cross-Site Scripting

Potential HTTP request smuggling in Apache Tomcat

A Reflected Cross Site Scripting flaw was found in all pki-core 10.x.x versions module from the pki-core server due to …

A vulnerability was found in all pki-core 10.x.x versions, where the Key Recovery Authority (KRA) Agent Service did not…

A Reflected Cross Site Scripting vulnerability was found in all pki-core 10.x.x versions, where the pki-ca module from …

In Dogtag PKI through 10.8.3, the pki.client.PKIConnection class did not enable python-requests certificate validation.…

A flaw was found in the Key Recovery Authority (KRA) Agent Service in pki-core 10.10.5 where it did not properly saniti…

A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scr…

References