# CVE-2020-8840: xsom: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... CVE-2020-8840 is fixed in 46 products on 1 platform, first by RHSA-2020:1644, released April 28, 2020. It is not reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/cve/CVE-2020-8840 - Priority: High - CVSS: 8.1 (Moderate) - EPSS: 0.2659 - CISA KEV: not listed - Exploited (vendor report): no - Publicly disclosed: no - Published: Apr 28, 2020 ## Description The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Security Fix(es): * jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig (CVE-2019-14540) * jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource (CVE-2019-16335) * jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* (CVE-2019-16942) * jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource (CVE-2019-16943) * jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* (CVE-2019-17531) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.2 Release Notes linked from the References section. ## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Linux | apache-commons-collections RHEL 8 | 0:3.2.2-10.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | apache-commons-lang RHEL 8 | 0:2.6-21.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | bea-stax-api RHEL 8 | 0:1.2.0-16.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | glassfish-fastinfoset RHEL 8 | 0:1.2.13-9.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | glassfish-jaxb-api RHEL 8 | 0:2.2.12-8.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | glassfish-jaxb-core RHEL 8 | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | glassfish-jaxb-runtime RHEL 8 | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | glassfish-jaxb-txw2 RHEL 8 | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | jackson-annotations RHEL 8 | 0:2.10.0-1.module+el8.2.0+5059+3eb3af25 | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | jackson-core RHEL 8 | 0:2.10.0-1.module+el8.2.0+5059+3eb3af25 | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | jackson-databind RHEL 8 | 0:2.10.0-1.module+el8.2.0+5059+3eb3af25 | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | jackson-jaxrs-json-provider RHEL 8 | 0:2.9.9-1.module+el8.1.0+3832+9784644d | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | jackson-jaxrs-providers RHEL 8 | 0:2.9.9-1.module+el8.1.0+3832+9784644d | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | jackson-module-jaxb-annotations RHEL 8 | 0:2.7.6-4.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | jakarta-commons-httpclient RHEL 8 | 1:3.1-28.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | javassist RHEL 8 | 0:3.18.1-8.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | javassist-javadoc RHEL 8 | 0:3.18.1-8.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | jss RHEL 8 | 0:4.6.2-4.module+el8.2.0+6123+b4678599 | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | jss-javadoc RHEL 8 | 0:4.6.2-4.module+el8.2.0+6123+b4678599 | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | ldapjdk RHEL 8 | 0:4.21.0-2.module+el8.2.0+4573+c3c38c7b | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | ldapjdk-javadoc RHEL 8 | 0:4.21.0-2.module+el8.2.0+4573+c3c38c7b | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | pki-base RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | pki-base-java RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | pki-ca RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | pki-kra RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | pki-server RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | pki-servlet-4.0-api RHEL 8 | 1:9.0.7-16.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | pki-servlet-engine RHEL 8 | 1:9.0.7-16.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | pki-symkey RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | pki-tools RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | python-nss-doc RHEL 8 | 0:1.0.1-10.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | python3-nss RHEL 8 | 0:1.0.1-10.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | python3-pki RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | relaxngDatatype RHEL 8 | 0:2011.1-7.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | resteasy RHEL 8 | 0:3.0.26-3.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | slf4j RHEL 8 | 0:1.7.25-4.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | slf4j-jdk14 RHEL 8 | 0:1.7.25-4.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | stax-ex RHEL 8 | 0:1.7.7-8.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | tomcatjss RHEL 8 | 0:7.4.1-2.module+el8.2.0+4573+c3c38c7b | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | velocity RHEL 8 | 0:1.7-24.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | xalan-j2 RHEL 8 | 0:2.7.1-38.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | xerces-j2 RHEL 8 | 0:2.11.0-34.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | xml-commons-apis RHEL 8 | 0:1.4.01-25.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | xml-commons-resolver RHEL 8 | 0:1.2-26.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | xmlstreambuffer RHEL 8 | 0:1.5.4-8.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | | Linux | xsom RHEL 8 | 0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c | [RHSA-2020:1644](https://patchblox.com/security/data/fix/linux/rhsa-2020-1644.md) | Apr 28, 2020 | --- Data as of 2026-11-08T00:53:09Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.