CVE-2019-14823 - A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions a

CVE-2019-14823

Summary

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.

References

Vulnerable Configurations

cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.4.6:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.4.6:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.4.7:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.4.7:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.5.3:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.5.3:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.5.4:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.5.4:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.6.0:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.6.0:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.6.1:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.6.1:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.6.2:*:*:*:*:*:*:*
cpe:2.3:a:jss_cryptomanager_project:jss_cryptomanager:4.6.2:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.8:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.9:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.10:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.1:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.2:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.3:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.4:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.5:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.6:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_eus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_server_tus:7.7:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:x64:*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:*:*:*:*:*:x64:*

CVSS

Base:	5.8 (as of 12-02-2023 - 23:34)
Impact:
Exploitability:

CWE

CWE-358

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:N

redhat via4

advisories

bugzilla

id	1747435
title	implicitly trusts the root certificate

oval

comment Red Hat Enterprise Linux must be installed
oval oval:com.redhat.rhba:tst:20070304026

AND

comment Red Hat Enterprise Linux 7 is installed
oval oval:com.redhat.rhba:tst:20150364027

AND
comment jss is earlier than 0:4.4.6-3.el7_7
oval oval:com.redhat.rhsa:tst:20193067001
comment jss is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20193067002
AND
comment jss-javadoc is earlier than 0:4.4.6-3.el7_7
oval oval:com.redhat.rhsa:tst:20193067003
comment jss-javadoc is signed with Red Hat redhatrelease2 key
oval oval:com.redhat.rhsa:tst:20193067004

rhsa

id	RHSA-2019:3067
released	2019-10-16
severity	Important
title	RHSA-2019:3067: jss security update (Important)

rhsa
id RHSA-2019:3225

rpms

jss-0:4.4.6-3.el7_7
jss-debuginfo-0:4.4.6-3.el7_7
jss-javadoc-0:4.4.6-3.el7_7
jss-0:4.4.4-6.el7_6
jss-debuginfo-0:4.4.4-6.el7_6
jss-javadoc-0:4.4.4-6.el7_6

refmap via4

confirm	https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14823
fedora	FEDORA-2019-24a0a2f24e FEDORA-2019-4d33c62860 FEDORA-2019-68c2fbcf82

Last major update

12-02-2023 - 23:34

Published

14-10-2019 - 20:15

Last modified

12-02-2023 - 23:34