CVEvulnerability

CVE-2019-14823

7.4 HIGH Published 2019-10-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-10-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.4 HIGH — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS 3.0 ([email protected])
6.8 MEDIUM — CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CVSS 2.0 ([email protected])
5.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:N
Weaknesses
CWE-295, CWE-358

Description

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.

Affected configurations

• jss cryptomanager project jss cryptomanager (>= 4.4.6 <= 4.4.7) • jss cryptomanager project jss cryptomanager (>= 4.5.3 <= 4.5.4) • jss cryptomanager project jss cryptomanager (>= 4.6.0 <= 4.6.2) • redhat enterprise linux 6.0 • redhat enterprise linux 6.1 • redhat enterprise linux 6.2 • redhat enterprise linux 6.3 • redhat enterprise linux 6.4 • redhat enterprise linux 6.5 • redhat enterprise linux 6.6 • redhat enterprise linux 6.7 • redhat enterprise linux 6.8 • redhat enterprise linux 6.9 • redhat enterprise linux 6.10 • redhat enterprise linux 7.0 • redhat enterprise linux 7.1 • redhat enterprise linux 7.2 • redhat enterprise linux 7.3 • redhat enterprise linux 7.4 • redhat enterprise linux 7.5 • redhat enterprise linux 7.6 • redhat enterprise linux 7.7 • redhat enterprise linux 8.0 • redhat enterprise linux desktop 7.0 • redhat enterprise linux eus 7.7 • redhat enterprise linux server 7.0 • redhat enterprise linux server aus 7.7 • redhat enterprise linux server tus 7.7 • redhat enterprise linux workstation 7.0

Related

Weakness · CWE (2)

  • CWE-295 Improper Certificate Validation weakness
  • CWE-358 Improperly Implemented Security Check for Standard weakness

References