{"id":"CVE-2019-14823","aliases":["DEBIAN-CVE-2019-14823","EUVD-2019-5951","GHSA-45q2-f3rm-5r6v","MGASA-2020-0018","RHSA-2019:3067","RHSA-2019:3225"],"status":"published","title":"A flaw was found in the \"Leaf and Chain\" OCSP policy implementation in JSS' CryptoManager...","description":"A flaw was found in the \"Leaf and Chain\" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.","severity":{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00859,"percentile":0.58727,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295","CWE-358"],"published":"2019-10-14T19:35:04Z","modified":"2026-09-21T07:02:41Z","fixes":[{"ecosystem":"Debian:12","package":"jss","fixed_in":["4.6.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jss","fixed_in":["4.6.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"jss","fixed_in":["4.6.2-1.mga7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"jss","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"jss-debuginfo","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"jss-javadoc","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"jss","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"jss-debuginfo","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"jss-javadoc","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"jss","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"jss-debuginfo","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"jss-javadoc","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"jss","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"jss-debuginfo","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"jss-javadoc","fixed_in":["0:4.4.6-3.el7_7"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"jss","fixed_in":["0:4.4.4-6.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"jss-debuginfo","fixed_in":["0:4.4.4-6.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"jss-javadoc","fixed_in":["0:4.4.4-6.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::server","package":"jss","fixed_in":["0:4.4.4-6.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::server","package":"jss-debuginfo","fixed_in":["0:4.4.4-6.el7_6"],"sources":["osv"]},{"ecosystem":"Red Hat:rhel_eus:7.6::server","package":"jss-javadoc","fixed_in":["0:4.4.4-6.el7_6"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-1"}]}],"versions":["4.3.1-4","4.3.1-5","4.3.1-6","4.3.1-7","4.4.2-1","4.4.2-2","4.4.2-3","4.4.2-4","4.4.2-5","4.4.2-6","4.4.3-1","4.4.4-1","4.5.0-1","4.5.0~a4-1","4.5.1-1","4.5.3-1","4.5.3-2","4.6.0-1","4.6.1-1","4.6.1-2","4.6.1-3"]},{"source":"osv","ecosystem":"Mageia:7","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.6.2-1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"jss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"jss-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"jss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"jss-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"jss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"jss-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"jss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"jss-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.6-3.el7_7"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.4-6.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"jss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.4-6.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::computenode","package":"jss-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.4-6.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::server","package":"jss","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.4-6.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::server","package":"jss-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.4-6.el7_6"}]}]},{"source":"osv","ecosystem":"Red Hat:rhel_eus:7.6::server","package":"jss-javadoc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.4.4-6.el7_6"}]}]}],"products":[{"vendor":"dogtag","product":"jss"},{"vendor":"jss_cryptomanager_project","product":"jss_cryptomanager"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_eus"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_aus"},{"vendor":"redhat","product":"enterprise_linux_server_tus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14823","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3067","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Exploit","Patch","Third Party Advisory","fix","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O53NXVKMF7PJCPMCJQHLMSYCUGDHGBVE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UZZWZLNALV6AOIBIHB3ZMNA5AGZMZAIY/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ENEN4DQBE6WOGEP5BQ5X62WZM7ZQEEBG/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3225","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14823","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14823","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1747435","tags":["report"]},{"url":"https://github.com/advisories/GHSA-45q2-f3rm-5r6v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14823","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0018.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25958","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/O53NXVKMF7PJCPMCJQHLMSYCUGDHGBVE/","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3067.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14823","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3225.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-14823","description":"A flaw was found in the \"Leaf and Chain\" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.","status":"published","published":"2019-10-14T19:35:04Z","modified":"2024-08-05T00:26:39.111Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-358"],"updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-5951","description":"A flaw was found in the \"Leaf and Chain\" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.","status":"published","published":"2019-10-14T19:35:04Z","modified":"2024-08-05T00:26:39Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T02:40:38.166988Z"}],"ghsa":[{"id":"GHSA-45q2-f3rm-5r6v","title":"A flaw was found in the \"Leaf and Chain\" OCSP policy implementation in JSS' CryptoManager...","description":"A flaw was found in the \"Leaf and Chain\" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.","status":"published","published":"2022-05-24T16:58:43Z","modified":"2023-02-13T00:30:59Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-295","CWE-358"],"updated_at":"2026-11-02T14:54:05.462623Z"}],"nvd":[{"id":"CVE-2019-14823","description":"A flaw was found in the \"Leaf and Chain\" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.","status":"published","published":"2019-10-14T20:15:10.54Z","modified":"2026-06-17T02:19:06.223Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-358","CWE-295"],"updated_at":"2026-11-02T14:05:31.860711Z"}],"osv":[{"id":"CVE-2019-14823","description":"A flaw was found in the \"Leaf and Chain\" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.","status":"published","published":"2019-10-14T20:15:10.54Z","modified":"2026-04-16T04:43:53.556242828Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14823","description":"A flaw was found in the \"Leaf and Chain\" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.","status":"published","published":"2019-10-14T20:15:10.54Z","modified":"2026-09-21T07:02:41.012934993Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:45:31.467893Z"},{"id":"RHSA-2019:3067","title":"Red Hat Security Advisory: jss security update","status":"published","published":"2024-09-16T02:56:21Z","modified":"2026-06-26T10:44:13Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"RHSA-2019:3225","title":"Red Hat Security Advisory: jss security update","status":"published","published":"2024-09-16T02:56:28Z","modified":"2026-06-26T10:44:28Z","cvss":[{"version":"3.0","score":6.8,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:06.0195Z"},{"id":"MGASA-2020-0018","title":"Updated jss packages fix security vulnerability","description":"Updated jss packages fix security vulnerability:\n\nA flaw was found in the \"Leaf and Chain\" OCSP policy implementation in\nJSS CryptoManager, where it implicitly trusted the root certificate of\na certificate chain. Applications using this policy may not properly\nverify the chain and could be vulnerable to attacks such as Man in the\nMiddle (CVE-2019-14823).\n","status":"published","published":"2020-01-05T15:37:51Z","modified":"2026-04-16T04:44:36.6158869Z","updated_at":"2026-11-02T15:49:41.151324Z"}]}}