CVE-2019-14823: Jss Cryptomanager Project Jss Cryptomanager

High severity, CVSS 7.4. EPSS: 0.9% chance of exploitation in the next 30 days.

A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a certificate chain. Applications using this policy may not properly verify the chain and could be vulnerable to attacks such as Man in the Middle.

Affected products

• Jss Cryptomanager Project Jss Cryptomanager: from 4.4.6, up to and including 4.4.7; from 4.5.3, up to and including 4.5.4; from 4.6.0, up to and including 4.6.2
• Red Hat Enterprise Linux: version 6.0 only; version 6.1 only; version 6.2 only; version 6.3 only; version 6.4 only; version 6.5 only; …
• Red Hat Enterprise Linux Desktop: version 7.0 only
• Red Hat Enterprise Linux Eus: version 7.7 only
• Red Hat Enterprise Linux Server: version 7.0 only
• Red Hat Enterprise Linux Server Aus: version 7.7 only
• Red Hat Enterprise Linux Server Tus: version 7.7 only
• Red Hat Enterprise Linux Workstation: version 7.0 only

Published 2019-10-14. Last modified 2026-06-17.