Business information leak In pki-core
Description
An unauthenticated client can query the Security Domain hosts inventory via GET /ca/rest/securityDomain/hosts and receive a structured response enumerating internal PKI/CA hosts and roles (security domain topology and participating subsystems), without requiring a principal, client certificate, or session.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Component |
|---|---|
 rpm rhel10 | |
rpm rhel6 | |
rpm rhel7 | |
rpm rhel8 | |
rpm rhel9 |
Aliases
1. 2. 3.