The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.
Security Fix(es):
* dogtag ca: token authentication bypass vulnerability (CVE-2023-4727)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Moderate: pki-core:10.6 and pki-deps:10.6 security update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.
Security Fix(es):
* jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.10 Release Notes linked from the References section.
Important: pki-core:10.6 and pki-deps:10.6 security and bug fix update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.
Security Fix(es):
* pki-core: access to external entities when parsing XML can lead to XXE (CVE-2022-2414)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.7 Release Notes linked from the References section.
Moderate: pki-core:10.6 security and bug fix update
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.
Security Fix(es):
* JSS: memory leak in TLS connection leads to OOM (CVE-2021-4213)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.6 Release Notes linked from the References section.
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.
Security Fix(es):
* pki-server: Dogtag installer "pkispawn" logs admin credentials into a world-readable log file (CVE-2021-3551)
The PKI installer "pkispawn" logs admin credentials into a
world-readable log file. It also looks like the installer is passing the
password as an insecure command line argument. The credentials are the
389-DS LDAP server's Directory Manager credentials. The Directory
Manager is 389-DS' equivalent of unrestricted root account. The user
bypasses permission checks and grants f