Description
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Dogtag | JSS | affects >= 4.4.6, affects >= 4.5.3, affects >= 4.6.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jss | 4.6.2-1 | — |
| Debian 12 | jss | 4.6.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | jss +1 | 4.4.6-3.el7_7 | RHSA-2019:3067 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7.6 EUS | jss +1 | 4.4.4-6.el7_6 | RHSA-2019:3225 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | jss +1 | 4.4.6-3.el7_7 | ELSA-2019-3067 |
Advisories 3
- RHSA-2019:3225 Red Hat Security Advisory: jss security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2019:3067 Red Hat Security Advisory: jss security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- ELSA-2019-3067 Important: jss security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Oct 16, 2019
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14823
- RHSA-2019:3067 vendor-advisory
- FEDORA-2019-68c2fbcf82 vendor-advisory
- FEDORA-2019-4d33c62860 vendor-advisory
- FEDORA-2019-24a0a2f24e vendor-advisory
- RHSA-2019:3225 vendor-advisory