A flaw was found in pki-core. Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. A remote attacker could potentially use this flaw to retrieve the content of arbitrary files by sending specially crafted HTTP requests.

Upstream PR: https://github.com/dogtagpki/pki/pull/4021

Upstream commit: https://github.com/dogtagpki/pki/commit/4e893243d72ad766558c10c907841f5f9c047055

A flaw was found in the all pki-core 10.x.x versions, where Token Processing Service (TPS) where it did not properly sanitize Profile IDs, enabling a Stored Cross-Site Scripting (XSS) vulnerability when the profile ID is printed. An attacker with sufficient permissions could trick an authenticated victim into executing a specially crafted Javascript code.

It was found that a mock CMC authentication plugin with a hardcoded secret was accidentally enabled by default in the pki-core package before 10.6.4. An attacker could potentially use this flaw to bypass the regular authentication process and trick the CA server into issuing certificates.