The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7077 advisory.

    The Public Key Infrastructure (PKI) Core contains fundamental packages     required by Red Hat Certificate System.

    Security Fix(es):

    * CVE-2022-2393 pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for     other UIDs by entering name in Subject field [rhcs_9.7] [BZ #2111493]

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:3394 advisory.

  - pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by     entering name in Subject field (CVE-2022-2393)

  - pki-core: access to external entities when parsing XML can lead to XXE (CVE-2022-2414)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2022-7086 advisory.

  - A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when     directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent     network to impersonate another user within the scope of the domain, but they would not be able to decrypt     message content. (CVE-2022-2393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:2293 advisory.

  - pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by     entering name in Subject field (CVE-2022-2393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2304 advisory.

  - A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when     directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent     network to impersonate another user within the scope of the domain, but they would not be able to decrypt     message content. (CVE-2022-2393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has packages installed that are affected by a vulnerability as referenced in the pki- core-11.3.0-0.2.beta1.el9 build changelog.

  - Improper authentication/authorization with caServerKeygen_DirUserCert profile (CVE-2022-2393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2023:2293 advisory.

  - A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when     directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent     network to impersonate another user within the scope of the domain, but they would not be able to decrypt     message content. (CVE-2022-2393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-2293 advisory.

  - A flaw was found in pki-core, which could allow a user to get a certificate for another user identity when     directory-based authentication is enabled. This flaw allows an authenticated attacker on the adjacent     network to impersonate another user within the scope of the domain, but they would not be able to decrypt     message content. (CVE-2022-2393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2022:7086 advisory.

  - pki-core: When using the caServerKeygen_DirUserCert profile, user can get certificates for other UIDs by     entering name in Subject field (CVE-2022-2393)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Published	Updated	Severity
194204	RHEL 7 : Red Hat Certificate System 9.7 CVE update (Moderate) (RHSA-2022:7077)	Nessus	Red Hat Local Security Checks	4/28/2024	6/3/2024	medium
176536	RHEL 8 : pki-core:10.6 (RHSA-2023:3394)	Nessus	Red Hat Local Security Checks	5/31/2023	4/28/2024	high
166438	Oracle Linux 7 : pki-core (ELSA-2022-7086)	Nessus	Oracle Linux Local Security Checks	10/24/2022	11/28/2022	medium
175457	RHEL 9 : pki-core (RHSA-2023:2293)	Nessus	Red Hat Local Security Checks	5/13/2023	4/28/2024	medium
183474	Amazon Linux 2 : pki-core (ALAS-2023-2304)	Nessus	Amazon Linux Local Security Checks	10/20/2023	10/20/2023	medium
191237	CentOS 9 : pki-core-11.3.0-0.2.beta1.el9	Nessus	CentOS Local Security Checks	2/29/2024	4/26/2024	medium
175621	AlmaLinux 9 : pki-core (ALSA-2023:2293)	Nessus	Alma Linux Local Security Checks	5/14/2023	5/14/2023	medium
175677	Oracle Linux 9 : pki-core (ELSA-2023-2293)	Nessus	Oracle Linux Local Security Checks	5/15/2023	9/18/2023	medium
166431	RHEL 7 : pki-core (RHSA-2022:7086)	Nessus	Red Hat Local Security Checks	10/24/2022	4/28/2024	medium

Detections

Analytics

Plugins Search

medium

high

medium

medium

medium

medium

medium

medium

medium