CVE-2019-10180
Fixed in a distro release EPSS <1%CVSS 2.4
A vulnerability was found in all pki-core 10.x.x version, where the Token Processing Service (TPS) did not properly sanitize several parameters stored for the tokens, possibly resulting in a Stored Cross Site Scripting (XSS) vulnerability. An attacker able to modify the parameters of any token could use this flaw to trick an authenticated user into executing arbitrary JavaScript code.
Products: dogtagpki, redhat certificate_system
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | dogtag-pki | no fix |
| Red Hat certificate system 9.7 | pki-core | 0:10.5.18-12.el7pki |
| Red Hat certificate system 9.7 | pki-core-debuginfo | 0:10.5.18-12.el7pki |
| Red Hat certificate system 9.7 | pki-ocsp | 0:10.5.18-12.el7pki |
| Red Hat certificate system 9.7 | pki-tks | 0:10.5.18-12.el7pki |
| Red Hat certificate system 9.7 | pki-tps | 0:10.5.18-12.el7pki |
| Red Hat certificate system 9.7 | redhat-pki-console-theme | 0:10.5.18-5.el7pki |
| Red Hat certificate system 9.7 | redhat-pki-server-theme | 0:10.5.18-5.el7pki |
| Red Hat certificate system 9.7 | redhat-pki-theme | 0:10.5.18-5.el7pki |
| Red Hat certificate system eus 9.4 | idm-console-framework | 0:1.1.17-4.el7dsrv |
| Red Hat certificate system eus 9.4 | pki-console | 0:10.5.9-2.el7pki |
| Red Hat certificate system eus 9.4 | pki-core | 0:10.5.9-15.el7pki |
| Red Hat certificate system eus 9.4 | pki-core-debuginfo | 0:10.5.9-15.el7pki |
| Red Hat certificate system eus 9.4 | pki-ocsp | 0:10.5.9-15.el7pki |
| Red Hat certificate system eus 9.4 | pki-tks | 0:10.5.9-15.el7pki |
| Red Hat certificate system eus 9.4 | pki-tps | 0:10.5.9-15.el7pki |
| Red Hat certificate system eus 9.4 | redhat-pki-console-theme | 0:10.5.9-5.el7pki |
| Red Hat certificate system eus 9.4 | redhat-pki-server-theme | 0:10.5.9-5.el7pki |
| Red Hat certificate system eus 9.4 | redhat-pki-theme | 0:10.5.9-5.el7pki |
| Ubuntu Pro 16.04 LTS | dogtag-pki | no fix |
| Ubuntu Pro 18.04 LTS | dogtag-pki | no fix |
| Ubuntu Pro 20.04 LTS | dogtag-pki | no fix |