CVE-2019-14823 Security feature bypass in JSS
Attackers can bypass certificate chain verification in JSS CryptoManager, enabling Man-in-the-Middle attacks against applications using the vulnerable OCSP policy.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-14823?
CVE-2019-14823 is a medium-severity vulnerability in Redhat Enterprise Linux, published on 14 Oct 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
Which versions are affected by CVE-2019-14823?
It affects 8 products.
Linux distribution packages (18)
jss Red Hat:enterprise_linux:7::client | All versions | 0:4.4.6-3.el7_7 |
jss-debuginfo Red Hat:enterprise_linux:7::client | All versions | 0:4.4.6-3.el7_7 |
jss-javadoc Red Hat:enterprise_linux:7::client | All versions | 0:4.4.6-3.el7_7 |
jss Red Hat:enterprise_linux:7::computenode | All versions | 0:4.4.6-3.el7_7 |
jss-debuginfo Red Hat:enterprise_linux:7::computenode | All versions | 0:4.4.6-3.el7_7 |
jss-javadoc Red Hat:enterprise_linux:7::computenode | All versions | 0:4.4.6-3.el7_7 |
jss Red Hat:enterprise_linux:7::server | All versions | 0:4.4.6-3.el7_7 |
jss-debuginfo Red Hat:enterprise_linux:7::server | All versions | 0:4.4.6-3.el7_7 |
jss-javadoc Red Hat:enterprise_linux:7::server | All versions | 0:4.4.6-3.el7_7 |
jss Red Hat:enterprise_linux:7::workstation | All versions | 0:4.4.6-3.el7_7 |
jss-debuginfo Red Hat:enterprise_linux:7::workstation | All versions | 0:4.4.6-3.el7_7 |
jss-javadoc Red Hat:enterprise_linux:7::workstation | All versions | 0:4.4.6-3.el7_7 |
jss Red Hat:rhel_eus:7.6::computenode | All versions | 0:4.4.4-6.el7_6 |
jss-debuginfo Red Hat:rhel_eus:7.6::computenode | All versions | 0:4.4.4-6.el7_6 |
jss-javadoc Red Hat:rhel_eus:7.6::computenode | All versions | 0:4.4.4-6.el7_6 |
jss Red Hat:rhel_eus:7.6::server | All versions | 0:4.4.4-6.el7_6 |
jss-debuginfo Red Hat:rhel_eus:7.6::server | All versions | 0:4.4.4-6.el7_6 |
jss-javadoc Red Hat:rhel_eus:7.6::server | All versions | 0:4.4.4-6.el7_6 |
Products include Jss Cryptomanager Project Jss Cryptomanager, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Eus, Redhat Enterprise Linux Server, Redhat Enterprise Linux Server Aus and 2 more.
How do I fix CVE-2019-14823?
Apply the vendor's patch.
Is CVE-2019-14823 being exploited?
There is no known exploitation of CVE-2019-14823 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2019-14823, GHSA-45q2-f3rm-5r6v, MGASA-2020-0018, RHSA-2019:3067, RHSA-2019:3225.