It was found that the Token Processing Service (TPS) did not properly sanitize the Token IDs from the "Activity" page, enabling a Stored Cross Site Scripting (XSS) vulnerability. An unauthenticated attacker could trick an authenticated victim into creating a specially crafted activity, which would execute arbitrary JavaScript code when viewed in a browser. All versions of pki-core are believed to be vulnerable.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0948 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab (CVE-2019-10178)

    * pki-core: unsanitized token parameters in TPS resulting in stored XSS (CVE-2019-10180)

    * pki-core: Stored XSS in TPS profile creation (CVE-2020-1696)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Update Batch Update Information to Version 20 [RHCS 9.4.z] (BZ#1931149)

    * Not able to launch pkiconsole -- RHEL 7.6.z backport request [RHCS 9.4.z] (BZ#1931718)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:0947 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate     System.

    Security Fix(es):

    * pki-core: stored Cross-site scripting (XSS) in the pki-tps web Activity tab (CVE-2019-10178)

    * pki-core: unsanitized token parameters in TPS resulting in stored XSS (CVE-2019-10180)

    * pki-core: Stored XSS in TPS profile creation (CVE-2020-1696)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * TPS - Add logging to tdbAddCertificatesForCUID if adding or searching for cert record fails (BZ#1710978)

    * TPS - Update Error Codes returned to client (CIW/ESC) to Match CS8 (BZ#1858860)

    * TPS - Server side key generation is not working for Identity only tokens - Missing some commits     (BZ#1858861)

    * TPS does not check token cuid on the user registration record during PIN reset (BZ#1858867)

    * Update RHCS version of CA, KRA, OCSP, and TKS so that it can be identified using a browser  [RHCS 9.7.z     BU 2] (BZ#1895104)

    * Update RHCS version of CA, KRA, OCSP, and TKS so that it can be identified using a browser  [RHCS 9.7.z     BU 4] (BZ#1914474)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
210283	RHEL 7 : Red Hat Certificate System (RHSA-2021:0948)	Nessus	Red Hat Local Security Checks	medium
194137	RHEL 7 : pki-core and redhat-pki-theme (RHSA-2021:0947)	Nessus	Red Hat Local Security Checks	medium

Detections

Analytics

CVE-2019-10178

medium

Tenable Plugins

medium

medium