Description
It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would execute arbitrary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The pki-core Project | pki-core | all versions | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 11 | dogtag-pki | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 18.04 LTS | dogtag-pki | No fix yet | — |
| Ubuntu Pro 16.04 LTS | dogtag-pki | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Certificate System Eus 9 | idm-console-framework | 1.1.17-4.el7dsrv | RHSA-2021:0948 |
| Red Hat Certificate System Eus 9 | pki-console | 10.5.9-2.el7pki | RHSA-2021:0948 |
| Red Hat Certificate System Eus 9 | pki-tks +3 | 10.5.9-15.el7pki | RHSA-2021:0948 |
| Red Hat Certificate System Eus 9 | redhat-pki-theme +2 | 10.5.9-5.el7pki | RHSA-2021:0948 |
| Red Hat Certificate System 9 | pki-tks +3 | 10.5.18-12.el7pki | RHSA-2021:0947 |
| Red Hat Certificate System 9 | redhat-pki-theme +2 | 10.5.18-5.el7pki | RHSA-2021:0947 |
Advisories 2
- RHSA-2021:0947 Red Hat Security Advisory: pki-core and redhat-pki-theme security and bug fix update Red Hat Security Advisories (RHSA) · Feb 24, 2026
- RHSA-2021:0948 Red Hat Security Advisory: Red Hat Certificate System security and bug fix update Red Hat Security Advisories (RHSA) · Feb 24, 2026