Important: pki-core:10.6 security update
Summary
RLSA-2021:0966: Important: pki-core:10.6 security update. Affects ldapjdk versions < 0:4.22.0-1.module+el8.4.0+418+b7ae1d4a. Fixed in 0:4.22.0-1.module+el8.4.0+418+b7ae1d4a. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Public Key Infrastructure (PKI) Core is a fundamental package required by the Rocky Enterprise Software Foundation Certificate System. It provides essential functionality for managing certificates and encryption keys.
Vulnerability Detail
The pki-core package is affected by a security vulnerability (CVE-2021-20179) that allows unprivileged users to renew any certificate. This vulnerability can be exploited to bypass certificate expiration and gain unauthorized access to systems or sensitive information. The vulnerability has a CVSS score of 8.1, indicating a high severity level.
How To Fix
Minimum fixed version
0:4.22.0-1.module+el8.4.0+418+b7ae1d4a
This is the first release that contains the fix.
sudo dnf update ldapjdkTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the security update to mitigate the risk effectively.
Conclusion
The pki-core package is affected by a high-severity security vulnerability that allows unprivileged users to renew any certificate. To mitigate this risk, it is crucial to update the pki-core package to version 10.6 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for ldapjdk →
FAQ
The vulnerability allows unprivileged users to renew any certificate, potentially leading to unauthorized access to systems or sensitive information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground, and it will alert you in real-time if any open-source vulnerabilities are detected.
There is no known exploit available for this vulnerability at the moment. However, it is crucial to apply the security update to prevent potential exploitation.
The only effective mitigation is to update the pki-core package to the latest version, which includes the necessary security patch.
This vulnerability was discovered by the Rocky Enterprise Software Foundation and reported to Red Hat.
Related vulnerabilities
Recent vulnerabilities recorded for ldapjdk.
