Main Vulnerability Database Vulnerabilities #VU68953

XML External Entity injection in PKI - CVE-2022-2414

Published: November 2, 2022 / Updated: October 11, 2024

Vulnerability identifier: #VU68953

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-2414

CWE-ID: CWE-611

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to insufficient validation of user-supplied XML input. A remote attacker can pass a specially crafted XML code to the affected application and view contents of arbitrary files on the system or initiate requests to external systems.

Successful exploitation of the vulnerability may allow an attacker to view contents of arbitrary file on the server or perform network scanning of internal and external infrastructure.

Affected software

PKI
Oracle Linux
Anolis OS
Red Hat Enterprise Linux for Power, big endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, little endian
CentOS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux for ARM 64 - Extended Update Support
openEuler
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
xsom
python-nss-doc
python3-nss
bea-stax-api
glassfish-fastinfoset
xml-commons-resolver
xml-commons-apis
xmlstreambuffer
stax-ex
velocity
slf4j
slf4j-jdk14
glassfish-jaxb-txw2
glassfish-jaxb-runtime
glassfish-jaxb-core
glassfish-jaxb-api
apache-commons-lang
xalan-j2
jackson-module-jaxb-annotations
jackson-jaxrs-json-provider
jackson-jaxrs-providers
jackson-databind
jackson-annotations
jackson-core
xerces-j2
resteasy
jakarta-commons-httpclient
apache-commons-collections
apache-commons-net
javassist-javadoc
javassist
jss
jss-javadoc
ldapjdk
ldapjdk-javadoc
tomcatjss
pki-servlet-4.0-api
pki-servlet-engine
redhat-pki-theme (Red Hat package)
pki-base
pki-base-java
pki-ca
pki-javadoc
pki-kra
pki-tools
pki-symkey
pki-server
pki-core (Red Hat package)
pki-tks
python3-pki
pki-help
pki-tps
pki-ocsp
pki-core
python3-idm-pki
idm-pki-symkey
idm-pki-tools
idm-pki-acme
idm-pki-base
idm-pki-base-java
idm-pki-server
idm-pki-kra
idm-pki-ca
pki-core-debugsource
pki-core-debuginfo
relaxngDatatype

How to mitigate CVE-2022-2414

Install updates from vendor's website.

xsom - update to 0-19.20110809svn
python-nss-doc - update to 1.0.1-10
python3-nss - update to 1.0.1-10
bea-stax-api - update to 1.2.0-16
glassfish-fastinfoset - update to 1.2.13-9
xml-commons-resolver - update to 1.2-26
xml-commons-apis - update to 1.4.01-25
xmlstreambuffer - update to 1.5.4-8
stax-ex - update to 1.7.7-8
velocity - update to 1.7-24
slf4j - update to 1.7.25-4
slf4j-jdk14 - update to 1.7.25-4
glassfish-jaxb-txw2 - update to 2.2.11-11
glassfish-jaxb-runtime - update to 2.2.11-11
glassfish-jaxb-core - update to 2.2.11-11
glassfish-jaxb-api - update to 2.2.12-8
apache-commons-lang - update to 2.6-21
xalan-j2 - update to 2.7.1-38
jackson-module-jaxb-annotations - update to 2.7.6-4
jackson-jaxrs-json-provider - update to 2.9.9-1
jackson-jaxrs-providers - update to 2.9.9-1
jackson-databind - update to 2.10.0-1
jackson-annotations - update to 2.10.0-1
jackson-core - update to 2.10.0-1
xerces-j2 - update to 2.11.0-34
resteasy - update to 3.0.26-6
jakarta-commons-httpclient - update to 3.1-28
apache-commons-collections - update to 3.2.2-10
apache-commons-net - update to 3.6-3
javassist-javadoc - update to 3.18.1-8
javassist - update to 3.18.1-8
jss - update to 4.9.4-1
jss-javadoc - update to 4.9.4-1
ldapjdk - update to 4.23.0-1
ldapjdk-javadoc - update to 4.23.0-1
tomcatjss - update to 7.7.1-1
pki-servlet-4.0-api - update to 9.0.50-1
pki-servlet-engine - update to 9.0.50-1
redhat-pki-theme (Red Hat package) - update to 10.5.18-16.el7pki
pki-base - update to 10.5.18-24
pki-base-java - update to 10.5.18-24
pki-ca - update to 10.5.18-24
pki-javadoc - update to 10.5.18-24
pki-kra - update to 10.5.18-24
pki-tools - update to 10.5.18-24
pki-symkey - update to 10.5.18-24
pki-server - update to 10.5.18-24
pki-core (Red Hat package) - addressed in versions 10.5.18-24.el7_9, 10.5.18-24.el7pki, 11.0.6-2.el9_0
pki-tks - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-ca - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
python3-pki - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-base - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-base-java - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-server - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-kra - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-help - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-tps - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-ocsp - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-symkey - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-tools - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
pki-core - addressed in versions 10.7.3-4, 10.7.3-5, 11.0.0-5
python3-idm-pki - update to 10.12.0-4
idm-pki-symkey - update to 10.12.0-4
idm-pki-tools - update to 10.12.0-4
idm-pki-acme - update to 10.12.0-4
idm-pki-base - update to 10.12.0-4
idm-pki-base-java - update to 10.12.0-4
idm-pki-server - update to 10.12.0-4
idm-pki-kra - update to 10.12.0-4
idm-pki-ca - update to 10.12.0-4
pki-core-debugsource - update to 11.0.0-5
pki-core-debuginfo - update to 11.0.0-5
relaxngDatatype - update to 2011.1-7

Links to Public Exploits and PoC-codes

External References

https://github.com/dogtagpki/pki/pull/4021