RedHat: RHSA-2022-7326:01 Important: pki-core security update | Lin...
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: pki-core security update
Advisory ID:       RHSA-2022:7326-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2022:7326
Issue date:        2022-11-02
CVE Names:         CVE-2022-2414 
=====================================================================

1. Summary:

An update for pki-core is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

The Public Key Infrastructure (PKI) Core contains fundamental packages
required by Red Hat Certificate System.

Security Fix(es):

* pki-core: access to external entities when parsing XML can lead to XXE
(CVE-2022-2414)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

2104676 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE

6. Package List:

Red Hat Enterprise Linux AppStream (v. 9):

Source:
pki-core-11.0.6-2.el9_0.src.rpm

aarch64:
pki-symkey-11.0.6-2.el9_0.aarch64.rpm
pki-tools-11.0.6-2.el9_0.aarch64.rpm

noarch:
pki-acme-11.0.6-2.el9_0.noarch.rpm
pki-base-11.0.6-2.el9_0.noarch.rpm
pki-base-java-11.0.6-2.el9_0.noarch.rpm
pki-ca-11.0.6-2.el9_0.noarch.rpm
pki-kra-11.0.6-2.el9_0.noarch.rpm
pki-server-11.0.6-2.el9_0.noarch.rpm
python3-pki-11.0.6-2.el9_0.noarch.rpm

ppc64le:
pki-symkey-11.0.6-2.el9_0.ppc64le.rpm
pki-tools-11.0.6-2.el9_0.ppc64le.rpm

s390x:
pki-symkey-11.0.6-2.el9_0.s390x.rpm
pki-tools-11.0.6-2.el9_0.s390x.rpm

x86_64:
pki-symkey-11.0.6-2.el9_0.x86_64.rpm
pki-tools-11.0.6-2.el9_0.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2022-2414
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBY2K9PNzjgjWX9erEAQjcRQ/+P+5dpX6ei0kSbhir0uUtECC+YYwY3WlU
+S7xfH/+sSjOKqLypjxrQd4lxO5DOV5dHW/BnXneo8/bPwti3VmrBM7zSHwLZKHU
oXj+kQnOzXhJrvnqvBY+anXAqKXJmbwD5dBwcsK3/Gc1C8xPjLEbYpj/2S0iYNDY
2Ls5SUEkkFSOdTSA79VSIp6LAaZN+Hz2tnMqU4uj8xEZ9j4WjO/S6XkadAgb5blP
5pYmPQu3m14VlFPyw0u6eGqmCZepr17yHKAy2EE19UYUUD9X6Au3AJg1RqH4NWHZ
X1Xs1u0yEIMFD61gikk3af63pi7BR8x++RlzpjUYjFyi05wys4a3Ldqvsmcvw4JO
XnDaQ6nDKDgno9lo/0jN62S5z/qXQmPqYuhdROZtyHrkzP6PvQpVgQT6M9z119E4
8eUY7m3cfcFxBaGlC+snTQLWiw9Hhf+x1yH9tlwIMzd3P7xqPdxPLRhQNQK1D0RN
bkUNiZfKDSHioW6YuHoLYCwnuj70jI/w9ET9zdThrLVKnqq4OU9TzG3BGii782lI
ODk6+xm8ViiZFdXwg8dYpeNTOeCM5saDHVkeI5CYfr5Zo8zTqnldITNuC8L+5hwR
BPB/fbfluxEtJR/ckhLA7AKzC826PGrk+oQwadJrX6CsN/qxTLJlkZizfPN9ZXb9
nHJWA6oIWAE=
=sFpp
-----END PGP SIGNATURE-----
--
RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2022-7326:01 Important: pki-core security update

An update for pki-core is now available for Red Hat Enterprise Linux 9

Summary

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.
Security Fix(es):
* pki-core: access to external entities when parsing XML can lead to XXE (CVE-2022-2414)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changesdescribed in this advisory, refer to:https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2022-2414 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux AppStream (v. 9):
Source: pki-core-11.0.6-2.el9_0.src.rpm
aarch64: pki-symkey-11.0.6-2.el9_0.aarch64.rpm pki-tools-11.0.6-2.el9_0.aarch64.rpm
noarch: pki-acme-11.0.6-2.el9_0.noarch.rpm pki-base-11.0.6-2.el9_0.noarch.rpm pki-base-java-11.0.6-2.el9_0.noarch.rpm pki-ca-11.0.6-2.el9_0.noarch.rpm pki-kra-11.0.6-2.el9_0.noarch.rpm pki-server-11.0.6-2.el9_0.noarch.rpm python3-pki-11.0.6-2.el9_0.noarch.rpm
ppc64le: pki-symkey-11.0.6-2.el9_0.ppc64le.rpm pki-tools-11.0.6-2.el9_0.ppc64le.rpm
s390x: pki-symkey-11.0.6-2.el9_0.s390x.rpm pki-tools-11.0.6-2.el9_0.s390x.rpm
x86_64: pki-symkey-11.0.6-2.el9_0.x86_64.rpm pki-tools-11.0.6-2.el9_0.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity
Advisory ID: RHSA-2022:7326-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2022:7326
Issued Date: : 2022-11-02
CVE Names: CVE-2022-2414

Topic

An update for pki-core is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, noarch, ppc64le, s390x, x86_64

Bugs Fixed

2104676 - CVE-2022-2414 pki-core: access to external entities when parsing XML can lead to XXE

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.