CVE-2019-10146: 
Apache Velocity engine vulnerability analysis and mitigation

A Reflected Cross Site Scripting (XSS) vulnerability was discovered in all pki-core 10.x.x versions, specifically affecting the CA Agent Service component. The vulnerability, identified as CVE-2019-10146, was discovered in March 2019 and involves improper sanitization of the certificate request page (CVE Mitre, NVD).

The vulnerability exists in the /ca/agent/ca/profileProcess form, where the basicConstraintsPathLen parameter is not properly sanitized by the server. This security flaw is considered Low severity because it requires the attacker to first request or predict a valid nonce. Without a valid nonce, no arbitrary HTML will be sent back to the victim's browser (Red Hat Bugzilla).

The security consequences of this vulnerability are limited due to the web UI using client-side TLS authentication, which means stealing a cookie would not be of much use to an attacker. The primary concern is the potential for website defacement (Red Hat Bugzilla).

The vulnerability was patched in multiple Red Hat Enterprise Linux versions through various security advisories. The fix was implemented upstream through commit b235c0f3c6c249dbba692410b525d8d6fb7409f4 in the dogtagpki/pki repository (Red Hat Bugzilla).