4 results · Feed
-
Medium 6.5
Jss: jss: jsstrustmanager does not verify nss trust flags on ca certificates
A flaw was found in JSS (Java Security Services). The JSSTrustManager class does not verify NSS trust flags when validating CA certificates, allowing certificates present in the NSS database without TRUSTED_CA flags to be accepted as trust anchors for TLS con…
-
Medium 5.9
Memory leak on tls connections
A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting the login page).
-
Unscored —
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the se…
-
Medium 6.8
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, …