CVE-2019-14823 – JSS: OCSP policy "Leaf and Chain" implicitly trusts the root certificate

https://notcve.org/view.php?id=CVE-2019-14823

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle. Se detectó un fallo en la implementación de la política OCSP "Leaf and Chain" en las versiones de CryptoManager de JSS versiones posteriores a 4.4.6, 4.5.3, 4.6.0, donde confiaba implícitamente en el certificado raíz de una cadena de certificados. Es posible que las aplicaciones que utilizan esta política no verifiquen correctamente la cadena y puedan ser vulnerables a ataques de tipo Man in the Middle. A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager, where it implicitly trusted the root certificate of a certificate chain. • https://access.redhat.com/errata/RHSA-2019:3067 https://access.redhat.com/errata/RHSA-2019:3225 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14823 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ENEN4DQBE6WOGEP5BQ5X62WZM7ZQEEBG https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O53NXVKMF7PJCPMCJQHLMSYCUGDHGBVE https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZZWZLNALV6AOIBIHB3ZMNA5AGZMZAIY https:& • CWE-295: Improper Certificate Validation CWE-358: Improperly Implemented Security Check for Standard •