CVE-2022-2414: dogtagpki

CVSS: 7.5v3.1HighModified

AliasesRHSA-2022:7326RHSA-2022:7470RHSA-2022:8799+5 more

Published 29-07-2022Last modified 03-08-2024

Vulnerability summary

CVE-2022-2414 is a high (CVSS 7.5) vulnerability in dogtagpki. EPSS estimates a 85.39% chance of exploitation in the next 30 days, higher than 99.7% of scored vulnerabilities.

Overall risk

47/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

85.39%

0%100%

Critical · -0.21 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1

RHSA-2023:3394 USN-7146-1

Timeline

29-07-2022
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. This flaw allows a remote attacker to potentially retrieve the content of arbitrary files by sending specially crafted HTTP requests.

CVSS metrics

4 scores · 4 sources · 1 version

v3.17.5

EPSS trend

Probability

85.39%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

-0.21 pp

From 85.61% on 20-09-2026

20-09-202620-10-2026

EPSS score

85.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-611Improper Restriction of XML External Entity ReferenceThe product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Affected systems

Redhat36 products

idm-pki-acme< 0:10.12.0-4.module+el8.7.0+16126+c5918a27
idm-pki-base< 0:10.12.0-4.module+el8.7.0+16126+c5918a27
idm-pki-base-java< 0:10.12.0-4.module+el8.7.0+16126+c5918a27
idm-pki-ca< 0:10.12.0-4.module+el8.7.0+16126+c5918a27
idm-pki-kra< 0:10.12.0-4.module+el8.7.0+16126+c5918a27

idm-pki-server< 0:10.12.0-4.module+el8.7.0+16126+c5918a27
idm-pki-symkey< 0:10.12.0-4.module+el8.7.0+16126+c5918a27
idm-pki-symkey-debuginfo< 0:10.12.0-4.module+el8.7.0+16126+c5918a27
idm-pki-tools< 0:10.12.0-4.module+el8.7.0+16126+c5918a27
idm-pki-tools-debuginfo< 0:10.12.0-4.module+el8.7.0+16126+c5918a27
jss< 0:4.6.2-12.module+el8.2.0+10554+cf83aa72 | < 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
jss-debuginfo< 0:4.6.2-12.module+el8.2.0+10554+cf83aa72 | < 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
jss-debugsource< 0:4.6.2-12.module+el8.2.0+10554+cf83aa72 | < 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
jss-javadoc< 0:4.6.2-12.module+el8.2.0+10554+cf83aa72 | < 0:4.8.1-2.module+el8.4.0+10451+3e5b5448
ldapjdk< 0:4.21.0-2.module+el8.2.0+6294+b7db4606 | < 0:4.22.0-1.module+el8.3.0+6784+6e1e4c62
ldapjdk-javadoc< 0:4.23.0-1.module+el8.5.0+11983+6ba118b4 | < 0:4.21.0-2.module+el8.2.0+6294+b7db4606 | < 0:4.22.0-1.module+el8.3.0+6784+6e1e4c62
pki-acme< 0:11.0.6-2.el9_0 | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-base< 0:11.0.6-2.el9_0 | < 0:10.5.18-24.el7_9 | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-base-java< 0:11.0.6-2.el9_0 | < 0:10.5.18-24.el7_9 | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-ca< 0:11.0.6-2.el9_0 | < 0:10.5.18-24.el7_9 | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-core< 0:11.0.6-2.el9_0 | < 0:10.12.0-4.module+el8.7.0+16126+c5918a27 | < 0:10.5.18-24.el7_9 | < 0:10.5.18-24.el7pki | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-core-debuginfo< 0:10.12.0-4.module+el8.7.0+16126+c5918a27 | < 0:10.5.18-24.el7_9 | < 0:10.5.18-24.el7pki | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-core-debugsource< 0:10.12.0-4.module+el8.7.0+16126+c5918a27 | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-javadoc< 0:10.5.18-24.el7_9
pki-kra< 0:11.0.6-2.el9_0 | < 0:10.5.18-24.el7_9 | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-ocsp< 0:10.5.18-24.el7pki
pki-server< 0:11.0.6-2.el9_0 | < 0:10.5.18-24.el7_9 | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-symkey< 0:11.0.6-2.el9_0 | < 0:10.5.18-24.el7_9 | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-symkey-debuginfo< 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-tks< 0:10.5.18-24.el7pki
pki-tools< 0:11.0.6-2.el9_0 | < 0:10.5.18-24.el7_9 | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-tools-debuginfo< 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
pki-tps< 0:10.5.18-24.el7pki
python3-idm-pki< 0:10.12.0-4.module+el8.7.0+16126+c5918a27
python3-pki< 0:11.0.6-2.el9_0 | < 0:10.8.4-1.module+el8.2.0+17305+ef598dea | < 0:10.10.5-6.module+el8.4.0+17580+3370c7a3
tomcatjss< 0:7.4.1-2.module+el8.2.0+6294+b7db4606 | < 0:7.6.1-1.module+el8.4.0+8778+d07929ff

Show all 36

Debian1 product

dogtag-pkiAll versions (No fix recorded)

Dogtagpki1 product

dogtagpki10.5.18 | 10.7.4 | 10.8.3 | 10.11.2 | 10.12.4 | 11.0.5 | 11.1.0

Ubuntu1 product

dogtag-pkiAll versions (No fix recorded) | < 11.0.0-1ubuntu0.1~esm1

4 vendors · 39 products

References

24 links

github.com/dogtagpki/pki/pull/4021X Refsource MISCREPORTIssue TrackingPatchThird Party Advisory
access.redhat.com/errata/RHSA-2022:7326Advisory
access.redhat.com/security/updates/classification/ARTICLE
bugzilla.redhat.com/show_bug.cgi?id=2104676REPORT
security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_7326.jsonAdvisory
access.redhat.com/security/cve/CVE-2022-2414REPORT
www.cve.org/CVERecord?id=CVE-2022-2414AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2022-2414Advisory
access.redhat.com/errata/RHSA-2022:7470Advisory
access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/indexARTICLE

Show all 24 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities