CVE-2019-14823
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager...
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
- Record
CVE-2019-14823- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Weakness
- CWE-358
- Updated
- 2026-11-02
EUVDEUVD-2019-5951
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
- Record
EUVD-2019-5951- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-45q2-f3rm-5r6v
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager...
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
- Record
GHSA-45q2-f3rm-5r6v- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-295, CWE-358
- Updated
- 2026-11-02
NVD
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
- Record
CVE-2019-14823- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - CVSS 2.0
- 5.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:N - Weakness
- CWE-358, CWE-295
- Updated
- 2026-11-02
OSV
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
- Record
CVE-2019-14823- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-14823
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
- Record
DEBIAN-CVE-2019-14823- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2019:3067
Red Hat Security Advisory: jss security update
- Record
RHSA-2019:3067- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVRHSA-2019:3225
Red Hat Security Advisory: jss security update
- Record
RHSA-2019:3225- CVSS 3.0
- 6.8 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2020-0018 No score
Updated jss packages fix security vulnerability
Updated jss packages fix security vulnerability:
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle (CVE-2019-14823).
- Record
MGASA-2020-0018- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
jssDebian:12 |
before 4.6.2-1 | 4.6.2-1 |
jssDebian:14 |
before 4.6.2-1, plus listed versions 4.3.1-44.3.1-54.3.1-64.3.1-74.4.2-1 Show 16 moreShow less4.4.2-24.4.2-34.4.2-44.4.2-54.4.2-64.4.3-14.4.4-14.5.0-14.5.0~a4-14.5.1-14.5.3-14.5.3-24.6.0-14.6.1-14.6.1-24.6.1-3 |
4.6.2-1 |
jssMageia:7 |
before 4.6.2-1.mga7 | 4.6.2-1.mga7 |
jssRed Hat:enterprise_linux:7::client |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jss-debuginfoRed Hat:enterprise_linux:7::client |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jss-javadocRed Hat:enterprise_linux:7::client |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jssRed Hat:enterprise_linux:7::computenode |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jss-debuginfoRed Hat:enterprise_linux:7::computenode |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jss-javadocRed Hat:enterprise_linux:7::computenode |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jssRed Hat:enterprise_linux:7::server |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
Show 11 moreShow less
| Package | Affected | Fixed |
|---|---|---|
jss-debuginfoRed Hat:enterprise_linux:7::server |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jss-javadocRed Hat:enterprise_linux:7::server |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jssRed Hat:enterprise_linux:7::workstation |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jss-debuginfoRed Hat:enterprise_linux:7::workstation |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jss-javadocRed Hat:enterprise_linux:7::workstation |
before 0:4.4.6-3.el7_7 | 0:4.4.6-3.el7_7 |
jssRed Hat:rhel_eus:7.6::computenode |
before 0:4.4.4-6.el7_6 | 0:4.4.4-6.el7_6 |
jss-debuginfoRed Hat:rhel_eus:7.6::computenode |
before 0:4.4.4-6.el7_6 | 0:4.4.4-6.el7_6 |
jss-javadocRed Hat:rhel_eus:7.6::computenode |
before 0:4.4.4-6.el7_6 | 0:4.4.4-6.el7_6 |
jssRed Hat:rhel_eus:7.6::server |
before 0:4.4.4-6.el7_6 | 0:4.4.4-6.el7_6 |
jss-debuginfoRed Hat:rhel_eus:7.6::server |
before 0:4.4.4-6.el7_6 | 0:4.4.4-6.el7_6 |
jss-javadocRed Hat:rhel_eus:7.6::server |
before 0:4.4.4-6.el7_6 | 0:4.4.4-6.el7_6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-14823 is a medium vulnerability (CVSS 6.8) in Dogtag Jss, published October 14, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.86%, the 58th percentile. Fixed in jss 4.6.2-1.
References
bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14823
access.redhat.com/errata/RHSA-2019:3067
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O53NXVKMF7PJCPMCJQHLMSYCUGDHGBVE
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2019-14823
github.com/advisories/GHSA-45q2-f3rm-5r6v
security-tracker.debian.org/tracker/CVE-2019-14823
advisories.mageia.org/MGASA-2020-0018.html
bugs.mageia.org/show_bug.cgi?id=25958
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3067.json
cve.org/CVERecord?id=CVE-2019-14823