CVSS2
Attack Vector
NETWORK
Attack Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
AI Score
Confidence
High
EPSS
Percentile
68.2%
CentOS Errata and Security Advisory CESA-2015:1347
Red Hat Certificate System is an enterprise software system designed to
manage enterprise public key infrastructure (PKI) deployments. PKI Core
contains fundamental packages required by Red Hat Certificate System, which
comprise the Certificate Authority (CA) subsystem.
Multiple cross-site scripting flaws were discovered in the Red Hat
Certificate System Agent and End Entity pages. An attacker could use these
flaws to perform a cross-site scripting (XSS) attack against victims using
the Certificate System’s web interface. (CVE-2012-2662)
This update also fixes the following bugs:
Previously, pki-core required the SSL version 3 (SSLv3) protocol ranges
to communicate with the 389-ds-base packages. However, recent changes to
389-ds-base disabled the default use of SSLv3 and enforced using protocol
ranges supported by secure protocols, such as the TLS protocol. As a
consequence, the CA failed to install during an Identity Management (IdM)
server installation. This update adds TLS-related parameters to the
server.xml file of the CA to fix this problem, and running the
ipa-server-install command now installs the CA as expected. (BZ#1171848)
Previously, the ipa-server-install script failed when attempting to
configure a stand-alone CA on systems with OpenJDK version 1.8.0 installed.
The pki-core build and runtime dependencies have been modified to use
OpenJDK version 1.7.0 during the stand-alone CA configuration. As a result,
ipa-server-install no longer fails in this situation. (BZ#1212557)
Creating a Red Hat Enterprise Linux 7 replica from a Red Hat Enterprise
Linux 6 replica running the CA service sometimes failed in IdM deployments
where the initial Red Hat Enterprise Linux 6 CA master had been removed.
This could cause problems in some situations, such as when migrating from
Red Hat Enterprise Linux 6 to Red Hat Enterprise Linux 7. The bug occurred
due to a problem in a previous version of IdM where the subsystem user,
created during the initial CA server installation, was removed together
with the initial master. This update adds the restore-subsystem-user.py
script that restores the subsystem user in the described situation, thus
enabling administrators to create a Red Hat Enterprise Linux 7 replica in
this scenario. (BZ#1225589)
Several Java import statements specify wildcard arguments. However, due
to the use of wildcard arguments in the import statements of the source
code contained in the Red Hat Enterprise Linux 6 maintenance branch, a name
space collision created the potential for an incorrect class to be
utilized. As a consequence, the Token Processing System (TPS) rebuild test
failed with an error message. This update addresses the bug by supplying
the fully named class in all of the affected areas, and the TPS rebuild
test no longer fails. (BZ#1144188)
Previously, pki-core failed to build with the rebased version of the
CMake build system during the TPS rebuild test. The pki-core build files
have been updated to comply with the rebased version of CMake. As a result,
pki-core builds successfully in the described scenario. (BZ#1144608)
Users of pki-core are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-cr-announce/2015-July/028336.html
Affected packages:
pki-ca
pki-common
pki-common-javadoc
pki-java-tools
pki-java-tools-javadoc
pki-native-tools
pki-selinux
pki-setup
pki-silent
pki-symkey
pki-util
pki-util-javadoc
Upstream details at:
https://access.redhat.com/errata/RHSA-2015:1347
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 6 | noarch | pki-ca | < 9.0.3-43.el6 | pki-ca-9.0.3-43.el6.noarch.rpm |
CentOS | 6 | noarch | pki-common | < 9.0.3-43.el6 | pki-common-9.0.3-43.el6.noarch.rpm |
CentOS | 6 | noarch | pki-common-javadoc | < 9.0.3-43.el6 | pki-common-javadoc-9.0.3-43.el6.noarch.rpm |
CentOS | 6 | noarch | pki-java-tools | < 9.0.3-43.el6 | pki-java-tools-9.0.3-43.el6.noarch.rpm |
CentOS | 6 | noarch | pki-java-tools-javadoc | < 9.0.3-43.el6 | pki-java-tools-javadoc-9.0.3-43.el6.noarch.rpm |
CentOS | 6 | i686 | pki-native-tools | < 9.0.3-43.el6 | pki-native-tools-9.0.3-43.el6.i686.rpm |
CentOS | 6 | noarch | pki-selinux | < 9.0.3-43.el6 | pki-selinux-9.0.3-43.el6.noarch.rpm |
CentOS | 6 | noarch | pki-setup | < 9.0.3-43.el6 | pki-setup-9.0.3-43.el6.noarch.rpm |
CentOS | 6 | noarch | pki-silent | < 9.0.3-43.el6 | pki-silent-9.0.3-43.el6.noarch.rpm |
CentOS | 6 | i686 | pki-symkey | < 9.0.3-43.el6 | pki-symkey-9.0.3-43.el6.i686.rpm |