Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2024-4222

Опубликовано: 02 июл. 2024
Источник: oracle-oval
Платформа: Oracle Linux 7

Описание

ELSA-2024-4222: pki-core security update (IMPORTANT)

[10.5.18-32]

  • ##########################################################################

  • RHEL 7.9 (Async Security Update CY24Q2.4):

  • ##########################################################################
  • Updated nspr-devel and nss-devel build requirements as well as nss and nss-tools runtime requirements (mharmsen)
  • Updated jss dependencies (mharmsen)
  • Added git build dependency (mharmsen)
  • Additional trivial fix (jmagne)
  • RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca: token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  • RHEL-24339 - pki-core - PrettyPrintCert does not properly translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  • RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  • ##########################################################################

  • RHCS 9.7 (Async Security Update CY24Q2.4):

  • ##########################################################################
  • Bug 2047831 - Coolkey Hardcoded RSA Max Key Size [RHCS 9.7.z] (jmagne)
  • Bug 2121463 - Add Secure Channel Support for AES-256 Keys [RHCS 9.7.z] (jmagne)
  • Bug 2177785 - TPS missing Host header field in HTTP/1.1 request message [RHCS 9.7.z] (mfargett)
  • Bug 2180920 - add AES support for TMS server-side keygen on latest HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  • Bug 2233158 - Make key wrapping algorithm configurable between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  • Bug 2253682 - pkidestroy log keeps HSM token password [RHCS 9.7.z] (mfargett, jmagne)
  • Bug 2265180 - Add Support for Symmetric Key Rollover [RHCS 9.7.z] (jmagne)
  • Bug 2280722 - Shared token is not generated for TPS and TKS during install despite adding pki_import_shared_secret=True param at install [RHCS 9.7.z] (jmagne)

[10.5.18-31]

  • ##########################################################################

  • RHEL 7.9 (Async Security Update CY24Q2.3):

  • ##########################################################################
  • Updated nspr-devel and nss-devel build requirements as well as nss and nss-tools runtime requirements (mharmsen)
  • Updated jss dependencies (mharmsen)
  • Added git build dependency (mharmsen)
  • Additional trivial fix (jmagne)
  • RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca: token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  • RHEL-24339 - pki-core - PrettyPrintCert does not properly translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  • RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  • ##########################################################################

  • RHCS 9.7 (Async Security Update CY24Q2.3):

  • ##########################################################################
  • Bug 2047831 - Coolkey Hardcoded RSA Max Key Size [RHCS 9.7.z] (jmagne)
  • Bug 2121463 - Add Secure Channel Support for AES-256 Keys [RHCS 9.7.z] (jmagne)
  • Bug 2177785 - TPS missing Host header field in HTTP/1.1 request message [RHCS 9.7.z] (mfargett)
  • Bug 2180920 - add AES support for TMS server-side keygen on latest HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  • Bug 2233158 - Make key wrapping algorithm configurable between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  • Bug 2253682 - pkidestroy log keeps HSM token password [RHCS 9.7.z] (mfargett, jmagne)
  • Bug 2265180 - Add Support for Symmetric Key Rollover [RHCS 9.7.z] (jmagne)
  • Bug 2280722 - Shared token is not generated for TPS and TKS during install despite adding pki_import_shared_secret=True param at install [RHCS 9.7.z] (jmagne)

[10.5.18-30]

  • ##########################################################################

  • RHEL 7.9 (Async Security Update CY24Q2.2):

  • ##########################################################################
  • Updated nspr-devel and nss-devel build requirements as well as nss and nss-tools runtime requirements (mharmsen)
  • Updated jss dependencies (mharmsen)
  • Added git build dependency (mharmsen)
  • Additional trivial fix (jmagne)
  • RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca: token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  • RHEL-24339 - pki-core - PrettyPrintCert does not properly translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  • RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  • ##########################################################################

  • RHCS 9.7 (Async Security Update CY24Q2.2):

  • ##########################################################################
  • Bug 2047831 - Coolkey Hardcoded RSA Max Key Size [RHCS 9.7.z] (jmagne)
  • Bug 2121463 - Add Secure Channel Support for AES-256 Keys [RHCS 9.7.z] (jmagne)
  • Bug 2177785 - TPS missing Host header field in HTTP/1.1 request message [RHCS 9.7.z] (mfargett)
  • Bug 2180920 - add AES support for TMS server-side keygen on latest HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  • Bug 2233158 - Make key wrapping algorithm configurable between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  • Bug 2253682 - pkidestroy log keeps HSM token password [RHCS 9.7.z] (mfargett, jmagne)
  • Bug 2265180 - Add Support for Symmetric Key Rollover [RHCS 9.7.z] (jmagne)
  • Bug 2280722 - Shared token is not generated for TPS and TKS during install despite adding pki_import_shared_secret=True param at install [RHCS 9.7.z] (jmagne)

[10.5.18-29]

  • ##########################################################################

  • RHEL 7.9 (Async Security Update CY24Q2.1):

  • ##########################################################################
  • Updated nspr-devel and nss-devel build requirements as well as nss and nss-tools runtime requirements (mharmsen)
  • Updated jss dependencies (mharmsen)
  • Added git build dependency (mharmsen)
  • Additional trivial fix (jmagne)
  • RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca: token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  • RHEL-24339 - pki-core - PrettyPrintCert does not properly translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  • RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  • ##########################################################################

  • RHCS 9.7 (Async Security Update CY24Q2.1):

  • ##########################################################################
  • Bug 2047831 - Coolkey Hardcoded RSA Max Key Size [RHCS 9.7.z] (jmagne)
  • Bug 2121463 - Add Secure Channel Support for AES-256 Keys [RHCS 9.7.z] (jmagne)
  • Bug 2177785 - TPS missing Host header field in HTTP/1.1 request message [RHCS 9.7.z] (mfargett)
  • Bug 2180920 - add AES support for TMS server-side keygen on latest HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  • Bug 2233158 - Make key wrapping algorithm configurable between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  • Bug 2253682 - pkidestroy log keeps HSM token password [RHCS 9.7.z] (mfargett, jmagne)
  • Bug 2265180 - Add Support for Symmetric Key Rollover [RHCS 9.7.z] (jmagne)
  • Bug 2280722 - Shared token is not generated for TPS and TKS during install despite adding pki_import_shared_secret=True param at install [RHCS 9.7.z] (jmagne)

[10.5.18-28]

  • ##########################################################################

  • RHEL 7.9 (Async Security Update CY24Q2):

  • ##########################################################################
  • Updated nspr-devel and nss-devel build requirements as well as nss and nss-tools runtime requirements (mharmsen)
  • Updated jss dependencies (mharmsen)
  • Added git build dependency (mharmsen)
  • RHEL-9917 - EMBARGOED CVE-2023-4727 pki-core: dogtag ca: token authentication bypass vulnerability [rhel-7.9.z] (jmagne)
  • RHEL-24339 - pki-core - PrettyPrintCert does not properly translate AIA information into a readable format [RHEL 7.9.z] (mfargett)
  • RHEL-26881 - Fix additional OID mappings [RHEL 7.9.z] (mfargett)
  • ##########################################################################

  • RHCS 9.7 (Async Security Update CY24Q2):

  • ##########################################################################
  • Bug 2047831 - Coolkey Hardcoded RSA Max Key Size [RHCS 9.7.z] (jmagne)
  • Bug 2121463 - Add Secure Channel Support for AES-256 Keys [RHCS 9.7.z] (jmagne)
  • Bug 2177785 - TPS missing Host header field in HTTP/1.1 request message [RHCS 9.7.z] (mfargett)
  • Bug 2180920 - add AES support for TMS server-side keygen on latest HSM / FIPS environment [RHCS 9.7.z] (jmagne)
  • Bug 2233158 - Make key wrapping algorithm configurable between AES-KWP and AES-CBC [RHCS 9.7.z] (jmagne)
  • Bug 2253682 - pkidestroy log keeps HSM token password [RHCS 9.7.z] (mfargett)
  • Bug 2265180 - Add Support for Symmetric Key Rollover [RHCS 9.7.z] (jmagne)

Обновленные пакеты

Oracle Linux 7

Oracle Linux aarch64

pki-base

10.5.18-32.el7_9

pki-base-java

10.5.18-32.el7_9

pki-ca

10.5.18-32.el7_9

pki-javadoc

10.5.18-32.el7_9

pki-kra

10.5.18-32.el7_9

pki-server

10.5.18-32.el7_9

pki-symkey

10.5.18-32.el7_9

pki-tools

10.5.18-32.el7_9

Oracle Linux x86_64

pki-base

10.5.18-32.el7_9

pki-base-java

10.5.18-32.el7_9

pki-ca

10.5.18-32.el7_9

pki-javadoc

10.5.18-32.el7_9

pki-kra

10.5.18-32.el7_9

pki-server

10.5.18-32.el7_9

pki-symkey

10.5.18-32.el7_9

pki-tools

10.5.18-32.el7_9

Связанные CVE

CVE-2023-4727

Ссылки на источники

Связанные уязвимости

ubuntu логотип

CVE-2023-4727

CVSS3: 7.5
ubuntu
около 1 года назад

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.

redhat логотип

CVE-2023-4727

CVSS3: 7.5
redhat
около 1 года назад

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.

nvd логотип

CVE-2023-4727

CVSS3: 7.5
nvd
около 1 года назад

A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escalation of privilege.

debian логотип

CVE-2023-4727

CVSS3: 7.5
debian
около 1 года назад

A flaw was found in dogtag-pki and pki-core. The token authentication ...

redos логотип

ROS-20250109-02

CVSS3: 7.5
redos
5 месяцев назад

Уязвимость pki-server

Уязвимость ELSA-2024-4222