Medium6.5Red Hat Linux Updated

Medium [CVE-2026-78323] JSSTrustManager does not verify NSS trust flags on CA certificates

This medium-severity Red Hat Linux advisory covers CVE-2026-78323 affecting Red Hat Certificate System 10, Red Hat Certificate System 11, Red Hat Enterprise Linux 10.

CVE-2026-78323 Published Aug 24, 2026Updated by vendor Aug 24, 2026

CVE-2026-78323

Affected products & platforms

Red Hat LinuxRed Hat Enterprise Linux

Open vendor advisory

Android app · Google Play

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery

Get CVE alerts See app features

Summary

JSSTrustManager does not verify NSS trust flags on CA certificates. Red Hat rates this moderate (CVSS 6.5).

Weakness: CWE-295.

Affected products named by the advisory: Red Hat Certificate System 10; Red Hat Certificate System 11; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; and 2 more.

Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat package: jss.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.

Official advisory · high-confidence parse· fetched 46 minutes ago·verify at source

Fixed versions

No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.

Official advisory · high-confidence parse· fetched 46 minutes ago·verify at source

Mitigation checklist

Recommended fix / mitigation

In default configurations, this flaw is mitigated by the native revocation verification check (certChainRevokeVerify) which is enabled by default on PKI client connections. Ensure that certificate revocation verification remains enabled (do not set isCertRevocationVerify to false). On the server side, the default TomcatJSS configuration uses JSSNativeTrustManager which is not affected by this flaw.

Official advisory · high-confidence parse· fetched 46 minutes ago·verify at source

Sources

Official and corroborating records used to build this advisory.

Red Hat Security Data APIofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://access.redhat.com/hydra/rest/securitydata/cve.json; this link opens the Red Hat Linux advisory index instead of the raw feed document.
Red Hat Linux
Official vendor advisoryofficial
Official advisory article fetched and its advisory identity was verified before publication. identity-sha256=987ff7fe3674cdf64fcf2eaa6996ec9a8a74c0eba5dfa3828ace1c4f665a9f21
Red Hat Linux
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-78323NVD CVE.org MITRE

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.