Main Vulnerability Database SB2019110525

SB2019110525 - Red Hat Enterprise Linux 8 update for the pki-core:10.6 and pki-deps:10:6 modules

Published: November 5, 2019 Updated: February 3, 2021

Security Bulletin ID SB2019110525

Severity

Medium

Patch available

YES

Number of vulnerabilities 2

Exploitation vector Remote access

Highest impact Information disclosure

Breakdown by Severity

Low
Medium
High
Critical

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Information disclosure (CVE-ID: CVE-2019-12086)

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to a polymorphic typing issue when Default Typing is enabled for an externally exposed JSON endpoint and the service has the mysql-connector-java jar in the classpath. A remote attacker can send a specially crafted JSON message and read arbitrary local files on the server due to the missing "com.mysql.cj.jdbc.admin.MiniAdmin" validation.

2) Information disclosure (CVE-ID: CVE-2019-12814)

The vulnerability allows a remote attacker to access sensitive information on a targeted system.

The vulnerability exist due to a polymorphic typing issue when Default Typing is enabled. A remote attacker can send a crafted JSON message that submits malicious input and gain access to sensitive information on the targeted system.

Remediation

Install update from vendor's website.

References

https://access.redhat.com/errata/RHBA-2019:3416