Headline
Red Hat Security Advisory 2023-1966-01
Red Hat Security Advisory 2023-1966-01 - The Public Key Infrastructure Core contains fundamental packages required by Red Hat Certificate System.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
====================================================================
Red Hat Security Advisory
Synopsis: Important: pki-core:10.6 security update
Advisory ID: RHSA-2023:1966-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:1966
Issue date: 2023-04-25
CVE Names: CVE-2022-2414
====================================================================
- Summary:
An update for the pki-core:10.6 module is now available for Red Hat
Enterprise Linux 8.4 Extended Update Support.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
- Relevant releases/architectures:
Red Hat Enterprise Linux AppStream EUS (v.8.4) - aarch64, noarch, ppc64le, s390x, x86_64
- Description:
The Public Key Infrastructure (PKI) Core contains fundamental packages
required by Red Hat Certificate System.
Security Fix(es):
- pki-core: access to external entities when parsing XML can lead to XXE
(CVE-2022-2414)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
- Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
- Bugs fixed (https://bugzilla.redhat.com/):
2104676 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE
- Package List:
Red Hat Enterprise Linux AppStream EUS (v.8.4):
Source:
jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.src.rpm
ldapjdk-4.22.0-1.module+el8.3.0+6784+6e1e4c62.src.rpm
pki-core-10.10.5-6.module+el8.4.0+17580+3370c7a3.src.rpm
tomcatjss-7.6.1-1.module+el8.4.0+8778+d07929ff.src.rpm
aarch64:
jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.aarch64.rpm
jss-debuginfo-4.8.1-2.module+el8.4.0+10451+3e5b5448.aarch64.rpm
jss-debugsource-4.8.1-2.module+el8.4.0+10451+3e5b5448.aarch64.rpm
jss-javadoc-4.8.1-2.module+el8.4.0+10451+3e5b5448.aarch64.rpm
pki-core-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.aarch64.rpm
pki-core-debugsource-10.10.5-6.module+el8.4.0+17580+3370c7a3.aarch64.rpm
pki-symkey-10.10.5-6.module+el8.4.0+17580+3370c7a3.aarch64.rpm
pki-symkey-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.aarch64.rpm
pki-tools-10.10.5-6.module+el8.4.0+17580+3370c7a3.aarch64.rpm
pki-tools-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.aarch64.rpm
noarch:
ldapjdk-4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch.rpm
ldapjdk-javadoc-4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch.rpm
pki-acme-10.10.5-6.module+el8.4.0+17580+3370c7a3.noarch.rpm
pki-base-10.10.5-6.module+el8.4.0+17580+3370c7a3.noarch.rpm
pki-base-java-10.10.5-6.module+el8.4.0+17580+3370c7a3.noarch.rpm
pki-ca-10.10.5-6.module+el8.4.0+17580+3370c7a3.noarch.rpm
pki-kra-10.10.5-6.module+el8.4.0+17580+3370c7a3.noarch.rpm
pki-server-10.10.5-6.module+el8.4.0+17580+3370c7a3.noarch.rpm
python3-pki-10.10.5-6.module+el8.4.0+17580+3370c7a3.noarch.rpm
tomcatjss-7.6.1-1.module+el8.4.0+8778+d07929ff.noarch.rpm
ppc64le:
jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.ppc64le.rpm
jss-debuginfo-4.8.1-2.module+el8.4.0+10451+3e5b5448.ppc64le.rpm
jss-debugsource-4.8.1-2.module+el8.4.0+10451+3e5b5448.ppc64le.rpm
jss-javadoc-4.8.1-2.module+el8.4.0+10451+3e5b5448.ppc64le.rpm
pki-core-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.ppc64le.rpm
pki-core-debugsource-10.10.5-6.module+el8.4.0+17580+3370c7a3.ppc64le.rpm
pki-symkey-10.10.5-6.module+el8.4.0+17580+3370c7a3.ppc64le.rpm
pki-symkey-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.ppc64le.rpm
pki-tools-10.10.5-6.module+el8.4.0+17580+3370c7a3.ppc64le.rpm
pki-tools-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.ppc64le.rpm
s390x:
jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.s390x.rpm
jss-debuginfo-4.8.1-2.module+el8.4.0+10451+3e5b5448.s390x.rpm
jss-debugsource-4.8.1-2.module+el8.4.0+10451+3e5b5448.s390x.rpm
jss-javadoc-4.8.1-2.module+el8.4.0+10451+3e5b5448.s390x.rpm
pki-core-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.s390x.rpm
pki-core-debugsource-10.10.5-6.module+el8.4.0+17580+3370c7a3.s390x.rpm
pki-symkey-10.10.5-6.module+el8.4.0+17580+3370c7a3.s390x.rpm
pki-symkey-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.s390x.rpm
pki-tools-10.10.5-6.module+el8.4.0+17580+3370c7a3.s390x.rpm
pki-tools-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.s390x.rpm
x86_64:
jss-4.8.1-2.module+el8.4.0+10451+3e5b5448.x86_64.rpm
jss-debuginfo-4.8.1-2.module+el8.4.0+10451+3e5b5448.x86_64.rpm
jss-debugsource-4.8.1-2.module+el8.4.0+10451+3e5b5448.x86_64.rpm
jss-javadoc-4.8.1-2.module+el8.4.0+10451+3e5b5448.x86_64.rpm
pki-core-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.x86_64.rpm
pki-core-debugsource-10.10.5-6.module+el8.4.0+17580+3370c7a3.x86_64.rpm
pki-symkey-10.10.5-6.module+el8.4.0+17580+3370c7a3.x86_64.rpm
pki-symkey-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.x86_64.rpm
pki-tools-10.10.5-6.module+el8.4.0+17580+3370c7a3.x86_64.rpm
pki-tools-debuginfo-10.10.5-6.module+el8.4.0+17580+3370c7a3.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2022-2414
https://access.redhat.com/security/updates/classification/#important
- Contact:
The Red Hat security contact is [email protected]. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2023 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBZEe/PNzjgjWX9erEAQg4CQ//RnrpSmI7T6BcHybiaeWTeQzwZb0BpQX8
vEQCJ9LRyHuuFZSsGH0yTNg6/i9tHBms3CJUKsyf4BvdeUTEl1lRFbVC1yqRfbbh
Fq6+AqFe28mjG6DeJAlH+zZcpRnDwsBLQxnMKi30JAzcZKSXVa5imBS3EFx64HnG
uvHuRu9Tf7FJiJAwWJhmZN7Njrqs/GbKNBHvIOjkWgDlpBPpAEl4nW7MZSZiuQ5I
q5MAf9gcRwToYPV1tgAUTbYPbEXFA+0SsIrhC++y8+SRCkcdYfJzJB32N4hQenPa
ErKC5zZ31AmwVdg6yIuDokUHkVFl0TPOPWwJEIAdn184dTmEyohCnIyPwakikc2v
QSZ/3pUtc5q3b2fCgUxCGG17jrlg8kxtNCjmXlmAPcdRMG40SMme7djNXJRPvAQO
me9ezRvlFKpESEklYg0AznDeZmEnYh3Wir5Xqmuoe2xgS5T9ZWvVDWR7X6Y2Zb8R
xi3DCZIFWI5TRaZlPqI82MMFwxeI9nl88KjCZZ+eig3Hs/OiL7qE1bSBLerviq8j
tLdXqTPV3Dc9FNHZWTvEAOXcKplmCNbd1w+ipq0Koxz5/FPsj1V7XpYBOOZngzXI
u6umMRmxF8i+yjhosOy2wBLHl7uwXLghhBc0u3Wz0HRI9T5RgmzV9DHT1B/rEarc
jhTEpvPmreA=EN+k
-----END PGP SIGNATURE-----
–
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce
Related news
Red Hat Security Advisory 2023-3394-01 - The Public Key Infrastructure Core contains fundamental packages required by Red Hat Certificate System.
An update for the pki-core:10.6 module is now available for Red Hat Enterprise Linux 8.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2393: A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but they would not be able t...
Red Hat Security Advisory 2023-1747-01 - The Public Key Infrastructure Core contains fundamental packages required by Red Hat Certificate System.
An update for the pki-core:10.6 module is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.2 Telecommunications Update Service, and Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2414: A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to pot...
There is an unauthorized buffer overflow vulnerability in Tenda AX12 v22.03.01.21 _ cn. This vulnerability can cause the web service not to restart or even execute arbitrary code. It is a different vulnerability from CVE-2022-2414.
Red Hat Security Advisory 2022-8915-01 - The Public Key Infrastructure Core contains fundamental packages required by Red Hat Certificate System.
An update is now available for Red Hat Certificate System 9.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2414: pki-core: access to external entities when parsing XML can lead to XXE
Red Hat Security Advisory 2022-8799-01 - The Public Key Infrastructure Core contains fundamental packages required by Red Hat Certificate System.
An update for the pki-core:10.6 and pki-deps:10.6 modules is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2414: pki-core: access to external entities when parsing XML can lead to XXE
An update for pki-core is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original. Related CVEs: * CVE-2022-2414: pki-core: access to external entities when parsing XML can lead to XXE
Attackers could ‘take full control of the infrastructure’, warn researchers
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.