CVE-2019-14823
JSS: OCSP policy "Leaf and Chain" implicitly trusts the root certificate
Severity
ImportantRed Hat Product Security
CVSS 3.0
Review impact separately from score.
Published · October 14, 2019
Updated · November 22, 2025
Description
A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.
Statement
Red Hat Certificate System 9.4 and above use the vulnerable policy.
Red Hat Enterprise Satellite 6 does not ship a vulnerable version of the JSS library.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.0 · 6.8CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
CWE-358 · Improperly Implemented Security Check for Standard