NetSight
IP …
high7.4

CVE-2019-14823

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the r…

Impact

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.

Affected products

VendorProductAffected versions
Jss Cryptomanager ProjectJss Cryptomanager
from 4.4.6 through 4.4.7
from 4.5.3 through 4.5.4
from 4.6.0 through 4.6.2
RedhatEnterprise Linux
Versions 6.0, 6.1, 6.2, 6.3, 6.4, 6.5
RedhatEnterprise Linux Desktop
Version 7.0
RedhatEnterprise Linux Eus
Version 7.7
RedhatEnterprise Linux Server
Version 7.0
RedhatEnterprise Linux Server Aus
Version 7.7
RedhatEnterprise Linux Server Tus
Version 7.7
RedhatEnterprise Linux Workstation
Version 7.0

Weakness classification

CWE-358CWE-295

References