rpm package
almalinux/idm-pki-kra
pkg:rpm/almalinux/idm-pki-kra
Vulnerabilities (5)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-54513 | Hig | 8.1 | < 11.9.0-4.el10_2.alma.1 | 11.9.0-4.el10_2.alma.1 | Jun 23, 2026 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), | |
| CVE-2026-54512 | Hig | 8.1 | < 11.9.0-4.el10_2.alma.1 | 11.9.0-4.el10_2.alma.1 | Jun 23, 2026 | jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization. | |
| CVE-2023-4727 | Hig | 7.5 | < 11.5.0-2.el9_4.alma.1 | 11.5.0-2.el9_4.alma.1 | Jun 11, 2024 | A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escal | |
| CVE-2022-2414 | Hig | 7.5 | < 10.12.0-4.module_el8.7.0+3316+50b99934 | 10.12.0-4.module_el8.7.0+3316+50b99934 | Jul 29, 2022 | Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests. | |
| CVE-2022-2393 | Med | 5.7 | < 11.3.0-1.el9 | 11.3.0-1.el9 | Jul 14, 2022 | A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but |
- affected < 11.9.0-4.el10_2.alma.1fixed 11.9.0-4.el10_2.alma.1
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(),
- affected < 11.9.0-4.el10_2.alma.1fixed 11.9.0-4.el10_2.alma.1
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, jackson-databind's PolymorphicTypeValidator (PTV) is the primary safety mechanism guarding polymorphic deserialization.
- affected < 11.5.0-2.el9_4.alma.1fixed 11.5.0-2.el9_4.alma.1
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, which may lead to escal
- affected < 10.12.0-4.module_el8.7.0+3316+50b99934fixed 10.12.0-4.module_el8.7.0+3316+50b99934
Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.
- affected < 11.3.0-1.el9fixed 11.3.0-1.el9
A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent network to impersonate another user within the scope of the domain, but