Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2019-14823

Опубликовано: 14 окт. 2019
Источник: nvd
CVSS3: 6.8
CVSS3: 7.4
CVSS2: 5.8
EPSS Низкий

Описание

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одновременно

Одно из

cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:*:*:*:*:*:*:*:*
Версия от 4.4.6 (включая) до 4.4.7 (включая)
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:*:*:*:*:*:*:*:*
Версия от 4.5.3 (включая) до 4.5.4 (включая)
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:*:*:*:*:*:*:*:*
Версия от 4.6.0 (включая) до 4.6.2 (включая)
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Конфигурация 2

Одновременно

Одно из

cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
Конфигурация 3

Одновременно

Одно из

cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:x64:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*

EPSS

Процентиль: 52%
0.00287
Низкий

6.8 Medium

CVSS3

7.4 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-358
CWE-295

Связанные уязвимости

ubuntu логотип

CVE-2019-14823

CVSS3: 7.4
ubuntu
больше 6 лет назад

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.

redhat логотип

CVE-2019-14823

CVSS3: 6.8
redhat
больше 6 лет назад

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.

debian логотип

CVE-2019-14823

CVSS3: 7.4
debian
больше 6 лет назад

A flaw was found in the "Leaf and Chain" OCSP policy implementation in ...

github логотип

GHSA-45q2-f3rm-5r6v

CVSS3: 7.4
github
больше 3 лет назад

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.

oracle-oval логотип

ELSA-2019-3067

oracle-oval
больше 6 лет назад

ELSA-2019-3067: jss security update (IMPORTANT)

EPSS

Процентиль: 52%
0.00287
Низкий

6.8 Medium

CVSS3

7.4 High

CVSS3

5.8 Medium

CVSS2

Дефекты

CWE-358
CWE-295