Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Mageia 7: 2020:0018 Critical: JSS Certificate Chain Trust Flaw

mageia
Calendar Grey January 5, 2020
Dist Mageia Esm H88
MGASA-2020-0018 - Updated jss packages fix security vulnerability Publication date: 05 Jan 2020 URL:
Updated jss packages fix security vulnerability: A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS CryptoManager, where it implicitly trusted the root cer...

Summary

Updated jss packages fix security vulnerability:
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle (CVE-2019-14823).

References

- https://bugs.mageia.org/show_bug.cgi?id=25958

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/O53NXVKMF7PJCPMCJQHLMSYCUGDHGBVE/

- https://www.cve.org/CVERecord?id=CVE-2019-14823

Topics%20covered

Topics Covered

security advisory man in the middle certificate chain mageia jss update policy flaw

Resolution

SRPMS

- 7/core/jss-4.6.2-1.mga7

Severity
critical
Lowest
Low
Medium
High
Critical

Publication date: 05 Jan 2020
URL: https://advisories.mageia.org/MGASA-2020-0018.html
Type: security
CVE: CVE-2019-14823

Topics%20covered

Topics Covered

security advisory man in the middle certificate chain mageia jss update policy flaw

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here