CVSS: 5.9EPSS: 0%CPEs: 3EXPL: 0CVE-2022-4132 – Memory leak on tls connections
https://notcve.org/view.php?id=CVE-2022-4132
A flaw was found in JSS. A memory leak in JSS requires non-standard configuration but is a low-effort DoS vector if configured that way (repeatedly hitting the login page). Se encontró una falla en JSS. Una pérdida de memoria en JSS requiere una configuración no estándar, pero es un vector DoS de bajo esfuerzo si se configura de esa manera (presionando repetidamente la página de inicio de sesión). • https://access.redhat.com/security/cve/CVE-2022-4132 https://bugzilla.redhat.com/show_bug.cgi?id=2147372 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 7.5EPSS: 3%CPEs: 7EXPL: 3CVE-2022-2414 – pki-core: access to external entities when parsing XML can lead to XXE
https://notcve.org/view.php?id=CVE-2022-2414
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. El acceso a entidades externas cuando son analizados documentos XML puede conllevar a ataques de tipo XML external entity (XXE). Este fallo permite a un atacante remoto recuperar potencialmente el contenido de archivos arbitrarios mediante el envío de peticiones HTTP especialmente diseñadas A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. • https://github.com/amitlttwo/CVE-2022-2414-Proof-Of-Concept https://github.com/satyasai1460/CVE-2022-2414 https://github.com/superhac/CVE-2022-2414-POC https://github.com/dogtagpki/pki/pull/4021 https://access.redhat.com/security/cve/CVE-2022-2414 https://bugzilla.redhat.com/show_bug.cgi?id=2104676 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2021-4213 – JSS: memory leak in TLS connection leads to OOM
https://notcve.org/view.php?id=CVE-2021-4213
A flaw was found in JSS, where it did not properly free up all memory. Over time, the wasted memory builds up in the server memory, saturating the server’s RAM. This flaw allows an attacker to force the invocation of an out-of-memory process, causing a denial of service. Se ha encontrado un fallo en JSS, que no libera apropiadamente toda la memoria. Con el tiempo, la memoria desperdiciada es acumulada en la memoria del servidor, saturando la RAM del mismo. • https://access.redhat.com/security/cve/CVE-2021-4213 https://bugzilla.redhat.com/show_bug.cgi?id=2042900 https://github.com/dogtagpki/jss/commit/3aabe0e9d59b0a42e68ac8cd0468f9c5179967d2 https://github.com/dogtagpki/jss/commit/5922560a78d0dee61af8a33cc9cfbf4cfa291448 https://security-tracker.debian.org/tracker/CVE-2021-4213 • CWE-401: Missing Release of Memory after Effective Lifetime •
CVSS: 8.8EPSS: 0%CPEs: 13EXPL: 0CVE-2021-3551 – pki-server: Dogtag installer "pkispawn" logs admin credentials into a world-readable log file
https://notcve.org/view.php?id=CVE-2021-3551
A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality. Se ha encontrado un fallo en el servidor PKI, donde el comando spkispawn, cuando es ejecutado en modo de depuración, almacena las credenciales de administrador en el archivo de registro de la instalación. Este fallo permite a un atacante local recuperar el archivo para obtener la contraseña de administrador y alcanzar privilegios de administrador en el administrador de Dogtag CA. • https://bugzilla.redhat.com/show_bug.cgi?id=1959971 https://access.redhat.com/security/cve/CVE-2021-3551 • CWE-312: Cleartext Storage of Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-25715 – pki-core: XSS in the certificate search results
https://notcve.org/view.php?id=CVE-2020-25715
A flaw was found in pki-core 10.9.0. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity. Se encontró un fallo en pki-core versión 10.9.0. Puede ser usado una petición POST especialmente diseñada para reflejar un ataque de tipo cross-site scripting (XSS) basado en DOM para inyectar código en el formulario de consulta de búsqueda que puede ejecutarse automáticamente. • https://bugzilla.redhat.com/show_bug.cgi?id=1891016 https://access.redhat.com/security/cve/CVE-2020-25715 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •