High severity · published Oct 14, 2019
CVE-2019-14823
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a…
7.4
CVSS
0.9%
EPSS
No
On KEV
Description
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
EL
Enterprise Linux · Redhat
6.0; 6.1; 6.2; 6.3; 6.4; 6.5; +14 more · source: NVD
EL
Enterprise Linux Desktop · Redhat
7.0 · source: NVD
EL
Enterprise Linux Eus · Redhat
7.7 · source: NVD
EL
Enterprise Linux Server · Redhat
7.0 · source: NVD
EL
Enterprise Linux Server Aus · Redhat
7.7 · source: NVD
EL
Enterprise Linux Server Tus · Redhat
7.7 · source: NVD
EL
Enterprise Linux Workstation · Redhat
7.0 · source: NVD
JC
Jss Cryptomanager · Jss Cryptomanager Project
4.4.6 through 4.4.7; 4.5.3 through 4.5.4; 4.6.0 through 4.6.2 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-14823
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-14823
Exploit
https://access.redhat.com/errata/RHSA-2019:3067
access.redhat.com
https://access.redhat.com/errata/RHSA-2019:3225
Issue Tracking
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14823
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ENEN4DQBE6WOGEP5BQ5X62WZM7ZQEEBG/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O53NXVKMF7PJCPMCJQHLMSYCUGDHGBVE/
lists.fedoraproject.org
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZZWZLNALV6AOIBIHB3ZMNA5AGZMZAIY/