RHSA-2023:1747: Important: pki-core:10.6 security update
Published Apr 12, 2023
·Updated
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.Security Fix(es): pki-core: access to external entities when parsing XML can lead to XXE (CVE-2022-2414) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Affected Software
33 affected componentsFixes available
redhat/jss<4.6.2-12.module+el8.2.0+10554+cf83aa72
4.6.2-12.module+el8.2.0+10554+cf83aa72
redhat/ldapjdk<4.21.0-2.module+el8.2.0+6294+b7db4606
4.21.0-2.module+el8.2.0+6294+b7db4606
redhat/pki-core<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/tomcatjss<7.4.1-2.module+el8.2.0+6294+b7db4606
7.4.1-2.module+el8.2.0+6294+b7db4606
redhat/ldapjdk<4.21.0-2.module+el8.2.0+6294+b7db4606
4.21.0-2.module+el8.2.0+6294+b7db4606
redhat/ldapjdk-javadoc<4.21.0-2.module+el8.2.0+6294+b7db4606
4.21.0-2.module+el8.2.0+6294+b7db4606
redhat/pki-base<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-base-java<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-ca<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-kra<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-server<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/python3-pki<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/tomcatjss<7.4.1-2.module+el8.2.0+6294+b7db4606
7.4.1-2.module+el8.2.0+6294+b7db4606
redhat/jss<4.6.2-12.module+el8.2.0+10554+cf83aa72
4.6.2-12.module+el8.2.0+10554+cf83aa72
redhat/jss-debuginfo<4.6.2-12.module+el8.2.0+10554+cf83aa72
4.6.2-12.module+el8.2.0+10554+cf83aa72
redhat/jss-debugsource<4.6.2-12.module+el8.2.0+10554+cf83aa72
4.6.2-12.module+el8.2.0+10554+cf83aa72
redhat/jss-javadoc<4.6.2-12.module+el8.2.0+10554+cf83aa72
4.6.2-12.module+el8.2.0+10554+cf83aa72
redhat/pki-core-debuginfo<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-core-debugsource<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-symkey<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-symkey-debuginfo<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-tools<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-tools-debuginfo<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/jss<4.6.2-12.module+el8.2.0+10554+cf83aa72
4.6.2-12.module+el8.2.0+10554+cf83aa72
redhat/jss-debuginfo<4.6.2-12.module+el8.2.0+10554+cf83aa72
4.6.2-12.module+el8.2.0+10554+cf83aa72
redhat/jss-debugsource<4.6.2-12.module+el8.2.0+10554+cf83aa72
4.6.2-12.module+el8.2.0+10554+cf83aa72
redhat/jss-javadoc<4.6.2-12.module+el8.2.0+10554+cf83aa72
4.6.2-12.module+el8.2.0+10554+cf83aa72
redhat/pki-core-debuginfo<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-core-debugsource<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-symkey<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-symkey-debuginfo<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-tools<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
redhat/pki-tools-debuginfo<10.8.4-1.module+el8.2.0+17305+ef598dea
10.8.4-1.module+el8.2.0+17305+ef598dea
Remediation
Event History
Apr 12, 2023
Advisory Published
via Red Hat·12:00 AM
Frequently Asked Questions
1
What is the severity of RHSA-2023:1747?
The severity of RHSA-2023:1747 is classified as important.
2
What vulnerability does RHSA-2023:1747 address?
RHSA-2023:1747 addresses an XML External Entity (XXE) vulnerability with the ID CVE-2022-2414.
3
How do I fix RHSA-2023:1747?
To fix RHSA-2023:1747, update the affected packages to their recommended versions listed in the advisory.
4
What affected packages are highlighted in RHSA-2023:1747?
Affected packages in RHSA-2023:1747 include pki-core, jss, ldapjdk, and tomcatjss.
5
Is there a risk of exploitation if RHSA-2023:1747 is not applied?
Yes, leaving RHSA-2023:1747 unpatched poses a risk of exploitation via the identified XXE vulnerability.