Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
Red Hat Customer Portal
  • Subscriptions
  • Downloads
  • Containers
  • Support Cases
  • Products & Services

    Products

    Support

    • Production Support
    • Development Support
    • Product Life Cycles

    Services

    • Consulting
    • Technical Account Management
    • Training & Certifications

    Documentation

    • Red Hat Enterprise Linux
    • Red Hat JBoss Enterprise Application Platform
    • Red Hat OpenStack Platform
    • Red Hat OpenShift Container Platform
    All Documentation

    Ecosystem Catalog

    • Red Hat Partner Ecosystem
    • Partner Resources
  • Tools

    Tools

    • Troubleshoot a product issue
    • Packages
    • Errata

    Customer Portal Labs

    • Configuration
    • Deployment
    • Security
    • Troubleshoot
    All labs

    Red Hat Insights

    Increase visibility into IT operations to detect and resolve technical issues before they impact your business.

    Learn More
    Go to Insights
  • Security

    Red Hat Product Security Center

    Engage with our Red Hat Product Security team, access security updates, and ensure your environments are not exposed to any known security vulnerabilities.

    Product Security Center

    Security Updates

    • Security Advisories
    • Red Hat CVE Database
    • Security Labs

    Keep your systems secure with Red Hat's specialized responses to security vulnerabilities.

    View Responses

    Resources

    • Security Blog
    • Security Measurement
    • Severity Ratings
    • Backporting Policies
    • Product Signing (GPG) Keys
  • Community

    Customer Portal Community

    • Discussions
    • Private Groups
    Community Activity

    Customer Events

    • Red Hat Convergence
    • Red Hat Summit

    Stories

    • Red Hat Subscription Value
    • You Asked. We Acted.
    • Open Source Communities
Or troubleshoot an issue.

Select Your Language

  • English
  • 한국어
  • 日本語
  • 中文 (中国)

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Virtualization
  • Red Hat Identity Management
  • Red Hat Directory Server
  • Red Hat Certificate System
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Update Infrastructure
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat CloudForms
  • Red Hat OpenStack Platform
  • Red Hat OpenShift Container Platform
  • Red Hat OpenShift Data Science
  • Red Hat OpenShift Online
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • OpenShift Dev Spaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat Single Sign On
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Thorntail
  • Red Hat build of Eclipse Vert.x
  • Red Hat build of OpenJDK
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Integration
  • Red Hat Fuse
  • Red Hat AMQ
  • Red Hat 3scale API Management
  • Red Hat JBoss Data Virtualization
  • Red Hat Process Automation
  • Red Hat Process Automation Manager
  • Red Hat Decision Manager
All Products
Red Hat Product Errata RHSA-2012:1103 - Security Advisory
Issued:
2012-07-19
Updated:
2012-07-19

RHSA-2012:1103 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Moderate: pki security and enhancement update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

Updated pki-common, pki-tps and pki-util packages that fix multiple
security issues and add one enhancement are now available for Red Hat
Certificate System 8.1.

The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Description

Red Hat Certificate System is an enterprise software system designed to
manage enterprise Public Key Infrastructure (PKI) deployments.

Multiple cross-site scripting flaws were discovered in the Red Hat
Certificate System Agent and End Entity pages. An attacker could use these
flaws to perform a cross-site scripting (XSS) attack against victims using
Certificate System's web interface. (CVE-2012-2662)

It was discovered that Red Hat Certificate System's Certificate Manager
did not properly check certificate revocation requests performed via its
web interface. An agent permitted to perform revocations of end entity
certificates could use this flaw to revoke the Certificate Authority (CA)
certificate. (CVE-2012-3367)

This update also adds the following enhancement:

  • Red Hat Certificate System 8.1 did not previously allow using Red Hat

Directory Server 9.0 as its internal database. This update adds support
for Directory Server 9.0. (BZ#547527, BZ#819508)

All users of Red Hat Certificate System 8.1 are advised to upgrade to these
updated packages, which correct these issues and add this enhancement.
After installing this update, all Red Hat Certificate System subsystems
must be restarted for the update to take effect.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

  • Red Hat Certificate System 8 x86_64
  • Red Hat Certificate System 8 i386

Fixes

  • BZ - 547527 - dogtag does not work with latest 389 DS
  • BZ - 826646 - CVE-2012-2662 Certificate System: multiple XSS flaws
  • BZ - 836268 - CVE-2012-3367 Certificate System: CA certificate can be revoked

CVEs

  • CVE-2012-2662
  • CVE-2012-3367

References

  • https://access.redhat.com/security/updates/classification/#moderate
Note: More recent versions of these packages may be available. Click a package name for more details.

Red Hat Certificate System 8

SRPM
pki-common-8.1.1-1.el5pki.src.rpm SHA-256: 9ad54b29a3847906cfaacb163779cf6e5f424d15c7d7a42340fe30db568fe62c
pki-tps-8.1.1-1.el5pki.src.rpm SHA-256: 565c0be3cc9e2d0ac89cd6990e7bce83e8e01a4322ac21f0367a5ef3d4c34a20
pki-util-8.1.1-1.el5pki.src.rpm SHA-256: 7baf175e081292f685a3d182d2ea1b3a9299b1bc1c5c1f9e48e9ba49db529e3b
x86_64
pki-common-8.1.1-1.el5pki.noarch.rpm SHA-256: 9bf2199c4cb67faaeb6f895b44e097747225812844cbb4b03a6cfd56444fa15d
pki-common-javadoc-8.1.1-1.el5pki.noarch.rpm SHA-256: 8ff59b0de364f63bbcc2c7ec60b6a9448dc1c8702797551c40f02259215a80e9
pki-tps-8.1.1-1.el5pki.x86_64.rpm SHA-256: 383130a92d72f683a5b26b2d653a08ea13d0fd4e2d9fa2e3dfff60df7fce9b49
pki-util-8.1.1-1.el5pki.noarch.rpm SHA-256: 5511d8f6959efe33313172da0154d25ce47c58119b921df385f1d750745cbd46
pki-util-javadoc-8.1.1-1.el5pki.noarch.rpm SHA-256: 19688423964c7f6e6df1e834c9e23042111d4aaa04c53acb29c472be7966f79f
i386
pki-common-8.1.1-1.el5pki.noarch.rpm SHA-256: 9bf2199c4cb67faaeb6f895b44e097747225812844cbb4b03a6cfd56444fa15d
pki-common-javadoc-8.1.1-1.el5pki.noarch.rpm SHA-256: 8ff59b0de364f63bbcc2c7ec60b6a9448dc1c8702797551c40f02259215a80e9
pki-tps-8.1.1-1.el5pki.i386.rpm SHA-256: e9d1663c67be86c1a4625ee3dbf61d3c8aa79629b62af5b995ff0e1f925ba436
pki-util-8.1.1-1.el5pki.noarch.rpm SHA-256: 5511d8f6959efe33313172da0154d25ce47c58119b921df385f1d750745cbd46
pki-util-javadoc-8.1.1-1.el5pki.noarch.rpm SHA-256: 19688423964c7f6e6df1e834c9e23042111d4aaa04c53acb29c472be7966f79f

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Red Hat

Quick Links

  • Downloads
  • Subscriptions
  • Support Cases
  • Customer Service
  • Product Documentation

Help

  • Contact Us
  • Customer Portal FAQ
  • Log-in Assistance

Site Info

  • Trust Red Hat
  • Browser Support Policy
  • Accessibility
  • Awards and Recognition
  • Colophon

Related Sites

  • redhat.com
  • developers.redhat.com
  • connect.redhat.com
  • cloud.redhat.com

About

  • Red Hat Subscription Value
  • About Red Hat
  • Red Hat Jobs
Copyright © 2023 Red Hat, Inc.
  • Privacy Statement
  • Customer Portal Terms of Use
  • All Policies and Guidelines
Red Hat Summit
Twitter