Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat IDM JSS packages may allow unauthorized access

published 2 years ago

Summary

The Red Hat IDM JSS, its debug info, Javadoc, LDAP JDK, and LDAP JDK Javadoc packages contain a flaw that could let an attacker bypass normal access controls. This could expose sensitive data or let the attacker perform actions they should not be able to. Apply the latest security update from Red Hat as soon as possible to fix the issue.

What to do

Update redhat idm-jss to version 0:4.11.0-1.module+el8.10.0+21280+cce842b8.
Update redhat idm-jss-debuginfo to version 0:4.11.0-1.module+el8.10.0+21280+cce842b8.
Update redhat idm-jss-javadoc to version 0:4.11.0-1.module+el8.10.0+21280+cce842b8.
Update redhat idm-ldapjdk to version 0:4.24.0-1.module+el8.10.0+21280+cce842b8.
Update redhat idm-ldapjdk-javadoc to version 0:4.24.0-1.module+el8.10.0+21280+cce842b8.
Update redhat idm-pki-acme to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat idm-pki-base to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat idm-pki-base-java to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat idm-pki-ca to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat idm-pki-kra to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat idm-pki-server to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat idm-pki-symkey to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat idm-pki-symkey-debuginfo to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat idm-pki-tools to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat idm-pki-tools-debuginfo to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat idm-tomcatjss to version 0:7.8.0-1.module+el8.10.0+21280+cce842b8.
Update redhat jss to version 0:4.11.0-1.module+el8.10.0+21280+cce842b8.
Update redhat jss-debugsource to version 0:4.11.0-1.module+el8.10.0+21280+cce842b8.
Update redhat ldapjdk to version 0:4.24.0-1.module+el8.10.0+21280+cce842b8.
Update redhat pki-core to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat pki-core-debuginfo to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat pki-core-debugsource to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat python3-idm-pki to version 0:10.15.1-1.module+el8.10.0+21991+2e8cd757.
Update redhat resteasy to version 0:3.0.26-7.module+el8.10.0+21132+79720f4e.
Update redhat resteasy-javadoc to version 0:3.0.26-7.module+el8.10.0+21132+79720f4e.
Update redhat tomcatjss to version 0:7.8.0-1.module+el8.10.0+21280+cce842b8.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:8::appstream	redhat	idm-jss	< 0:4.11.0-1.module+el8.10.0+21280+cce842b8 Fix: upgrade to 0:4.11.0-1.module+el8.10.0+21280+cce842b8
Red Hat:enterprise_linux:8::appstream	redhat	idm-jss-debuginfo	< 0:4.11.0-1.module+el8.10.0+21280+cce842b8 Fix: upgrade to 0:4.11.0-1.module+el8.10.0+21280+cce842b8
Red Hat:enterprise_linux:8::appstream	redhat	idm-jss-javadoc	< 0:4.11.0-1.module+el8.10.0+21280+cce842b8 Fix: upgrade to 0:4.11.0-1.module+el8.10.0+21280+cce842b8
Red Hat:enterprise_linux:8::appstream	redhat	idm-ldapjdk	< 0:4.24.0-1.module+el8.10.0+21280+cce842b8 Fix: upgrade to 0:4.24.0-1.module+el8.10.0+21280+cce842b8
Red Hat:enterprise_linux:8::appstream	redhat	idm-ldapjdk-javadoc	< 0:4.24.0-1.module+el8.10.0+21280+cce842b8 Fix: upgrade to 0:4.24.0-1.module+el8.10.0+21280+cce842b8
Red Hat:enterprise_linux:8::appstream	redhat	idm-pki-acme	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	idm-pki-base	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	idm-pki-base-java	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	idm-pki-ca	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	idm-pki-kra	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	idm-pki-server	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	idm-pki-symkey	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	idm-pki-symkey-debuginfo	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	idm-pki-tools	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	idm-pki-tools-debuginfo	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	idm-tomcatjss	< 0:7.8.0-1.module+el8.10.0+21280+cce842b8 Fix: upgrade to 0:7.8.0-1.module+el8.10.0+21280+cce842b8
Red Hat:enterprise_linux:8::appstream	redhat	jss	< 0:4.11.0-1.module+el8.10.0+21280+cce842b8 Fix: upgrade to 0:4.11.0-1.module+el8.10.0+21280+cce842b8
Red Hat:enterprise_linux:8::appstream	redhat	jss-debugsource	< 0:4.11.0-1.module+el8.10.0+21280+cce842b8 Fix: upgrade to 0:4.11.0-1.module+el8.10.0+21280+cce842b8
Red Hat:enterprise_linux:8::appstream	redhat	ldapjdk	< 0:4.24.0-1.module+el8.10.0+21280+cce842b8 Fix: upgrade to 0:4.24.0-1.module+el8.10.0+21280+cce842b8
Red Hat:enterprise_linux:8::appstream	redhat	pki-core	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	pki-core-debuginfo	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	pki-core-debugsource	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	python3-idm-pki	< 0:10.15.1-1.module+el8.10.0+21991+2e8cd757 Fix: upgrade to 0:10.15.1-1.module+el8.10.0+21991+2e8cd757
Red Hat:enterprise_linux:8::appstream	redhat	resteasy	< 0:3.0.26-7.module+el8.10.0+21132+79720f4e Fix: upgrade to 0:3.0.26-7.module+el8.10.0+21132+79720f4e
Red Hat:enterprise_linux:8::appstream	redhat	resteasy-javadoc	< 0:3.0.26-7.module+el8.10.0+21132+79720f4e Fix: upgrade to 0:3.0.26-7.module+el8.10.0+21132+79720f4e
Red Hat:enterprise_linux:8::appstream	redhat	tomcatjss	< 0:7.8.0-1.module+el8.10.0+21280+cce842b8 Fix: upgrade to 0:7.8.0-1.module+el8.10.0+21280+cce842b8

Original advisory text

Red Hat Security Advisory: pki-core security update

References

https://access.redhat.com/errata/RHSA-2024:4367 Vendor Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=2232218 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_4367.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2023-4727 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2023-4727 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2023-4727 Vendor Advisory
https://github.com/advisories/GHSA-rvm7-rc5g-c98q Vendor Advisory
https://github.com/dogtagpki/pki/commit/54e5b3c5932ad634b5ddf5b1d4d88c9419d6f720 Third Party Advisory
https://github.com/dogtagpki/pki/commit/aa7161ba378caf5cf0471aafb679a842679c8388 Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

7.5 High

Timeline

Published16 Sep 2024

Updated23 Sep 2026

First seen23 Sep 2026

Sources

RHSA-2024:4367 · OSV

Track software like this

Free during beta