CVE-2019-14823: High severity jss cryptomanager vulnerability
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
Other sources
When configured with the leaf and chain OCSP policy, JSS assumes that the root is trusted, and there is no attempt to validate it. This could allow a specially crafted certificate to be accepted by the application, and could be used, for example, in Man in the Middle attacks.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-14823?
CVE-2019-14823 has been rated as a medium severity vulnerability due to its potential impact on certificate chain validation.
How do I fix CVE-2019-14823?
To fix CVE-2019-14823, update JSS CryptoManager to version 4.4.7 or later, 4.5.4 or later, or 4.6.2 or later.
Which versions of JSS CryptoManager are affected by CVE-2019-14823?
JSS CryptoManager versions 4.4.6, 4.5.3, and 4.6.0 are affected by CVE-2019-14823.
What applications are at risk due to CVE-2019-14823?
Applications using the 'Leaf and Chain' OCSP policy in affected versions of JSS CryptoManager may be at risk due to CVE-2019-14823.
Is there a workaround for CVE-2019-14823 if I cannot update immediately?
Currently, there are no documented workarounds for CVE-2019-14823, so updating is the recommended approach.