# ELSA-2020-4847: Security update for 47 packages ELSA-2020-4847, released November 10, 2020, fixes 13 CVEs across 47 products. One of them is being exploited (CVE-2020-11023); 1 on CISA KEV. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/fix/linux/elsa-2020-4847 - Platform: Linux - Released: Nov 10, 2020 - Priority: Patch now (Closes CVE-2020-11023, exploited (CISA KEV)) - CVEs: 13, exploited: 1, on CISA KEV: 1 - Vendor advisory: https://linux.oracle.com/errata/ELSA-2020-4847.html ## Applies to | Product | Release | Fixed in | |---|---|---| | [apache-commons-collections](https://patchblox.com/security/data/product/linux/apache-commons-collections.md) | ol 8 | 0:3.2.2-10.module+el8.3.0+7697+44932688 | | [apache-commons-lang](https://patchblox.com/security/data/product/linux/apache-commons-lang.md) | ol 8 | 0:2.6-21.module+el8.3.0+7697+44932688 | | [apache-commons-net](https://patchblox.com/security/data/product/linux/apache-commons-net.md) | ol 8 | 0:3.6-3.module+el8.3.0+7697+44932688 | | [bea-stax-api](https://patchblox.com/security/data/product/linux/bea-stax-api.md) | ol 8 | 0:1.2.0-16.module+el8.3.0+7697+44932688 | | [glassfish-fastinfoset](https://patchblox.com/security/data/product/linux/glassfish-fastinfoset.md) | ol 8 | 0:1.2.13-9.module+el8.3.0+7697+44932688 | | [glassfish-jaxb-api](https://patchblox.com/security/data/product/linux/glassfish-jaxb-api.md) | ol 8 | 0:2.2.12-8.module+el8.3.0+7697+44932688 | | [glassfish-jaxb-core](https://patchblox.com/security/data/product/linux/glassfish-jaxb-core.md) | ol 8 | 0:2.2.11-11.module+el8.3.0+7697+44932688 | | [glassfish-jaxb-runtime](https://patchblox.com/security/data/product/linux/glassfish-jaxb-runtime.md) | ol 8 | 0:2.2.11-11.module+el8.3.0+7697+44932688 | | [glassfish-jaxb-txw2](https://patchblox.com/security/data/product/linux/glassfish-jaxb-txw2.md) | ol 8 | 0:2.2.11-11.module+el8.3.0+7697+44932688 | | [jackson-annotations](https://patchblox.com/security/data/product/linux/jackson-annotations.md) | ol 8 | 0:2.10.0-1.module+el8.3.0+7697+44932688 | | [jackson-core](https://patchblox.com/security/data/product/linux/jackson-core.md) | ol 8 | 0:2.10.0-1.module+el8.3.0+7697+44932688 | | [jackson-databind](https://patchblox.com/security/data/product/linux/jackson-databind.md) | ol 8 | 0:2.10.0-1.module+el8.3.0+7697+44932688 | | [jackson-jaxrs-json-provider](https://patchblox.com/security/data/product/linux/jackson-jaxrs-json-provider.md) | ol 8 | 0:2.9.9-1.module+el8.3.0+7697+44932688 | | [jackson-jaxrs-providers](https://patchblox.com/security/data/product/linux/jackson-jaxrs-providers.md) | ol 8 | 0:2.9.9-1.module+el8.3.0+7697+44932688 | | [jackson-module-jaxb-annotations](https://patchblox.com/security/data/product/linux/jackson-module-jaxb-annotations.md) | ol 8 | 0:2.7.6-4.module+el8.3.0+7697+44932688 | | [jakarta-commons-httpclient](https://patchblox.com/security/data/product/linux/jakarta-commons-httpclient.md) | ol 8 | 1:3.1-28.module+el8.3.0+7697+44932688 | | [javassist](https://patchblox.com/security/data/product/linux/javassist.md) | ol 8 | 0:3.18.1-8.module+el8.3.0+7697+44932688 | | [javassist-javadoc](https://patchblox.com/security/data/product/linux/javassist-javadoc.md) | ol 8 | 0:3.18.1-8.module+el8.3.0+7697+44932688 | | [jss](https://patchblox.com/security/data/product/linux/jss.md) | ol 8 | 0:4.7.3-1.module+el8.3.0+7857+983338ee | | [jss-javadoc](https://patchblox.com/security/data/product/linux/jss-javadoc.md) | ol 8 | 0:4.7.3-1.module+el8.3.0+7857+983338ee | | [ldapjdk](https://patchblox.com/security/data/product/linux/ldapjdk.md) | ol 8 | 0:4.22.0-1.module+el8.3.0+7857+983338ee | | [ldapjdk-javadoc](https://patchblox.com/security/data/product/linux/ldapjdk-javadoc.md) | ol 8 | 0:4.22.0-1.module+el8.3.0+7857+983338ee | | [pki-base](https://patchblox.com/security/data/product/linux/pki-base.md) | ol 8 | 0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee | | [pki-base-java](https://patchblox.com/security/data/product/linux/pki-base-java.md) | ol 8 | 0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee | | [pki-ca](https://patchblox.com/security/data/product/linux/pki-ca.md) | ol 8 | 0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee | | [pki-kra](https://patchblox.com/security/data/product/linux/pki-kra.md) | ol 8 | 0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee | | [pki-server](https://patchblox.com/security/data/product/linux/pki-server.md) | ol 8 | 0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee | | [pki-servlet-4.0-api](https://patchblox.com/security/data/product/linux/pki-servlet-4.0-api.md) | ol 8 | 1:9.0.30-1.module+el8.3.0+7697+44932688 | | [pki-servlet-engine](https://patchblox.com/security/data/product/linux/pki-servlet-engine.md) | ol 8 | 1:9.0.30-1.module+el8.3.0+7697+44932688 | | [pki-symkey](https://patchblox.com/security/data/product/linux/pki-symkey.md) | ol 8 | 0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee | | [pki-tools](https://patchblox.com/security/data/product/linux/pki-tools.md) | ol 8 | 0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee | | [python-nss-doc](https://patchblox.com/security/data/product/linux/python-nss-doc.md) | ol 8 | 0:1.0.1-10.module+el8.3.0+7697+44932688 | | [python3-nss](https://patchblox.com/security/data/product/linux/python3-nss.md) | ol 8 | 0:1.0.1-10.module+el8.3.0+7697+44932688 | | [python3-pki](https://patchblox.com/security/data/product/linux/python3-pki.md) | ol 8 | 0:10.9.4-1.0.1.module+el8.3.0+7857+983338ee | | [relaxngDatatype](https://patchblox.com/security/data/product/linux/relaxngdatatype.md) | ol 8 | 0:2011.1-7.module+el8.3.0+7697+44932688 | | [resteasy](https://patchblox.com/security/data/product/linux/resteasy.md) | ol 8 | 0:3.0.26-3.module+el8.3.0+7697+44932688 | | [slf4j](https://patchblox.com/security/data/product/linux/slf4j.md) | ol 8 | 0:1.7.25-4.module+el8.3.0+7697+44932688 | | [slf4j-jdk14](https://patchblox.com/security/data/product/linux/slf4j-jdk14.md) | ol 8 | 0:1.7.25-4.module+el8.3.0+7697+44932688 | | [stax-ex](https://patchblox.com/security/data/product/linux/stax-ex.md) | ol 8 | 0:1.7.7-8.module+el8.3.0+7697+44932688 | | [tomcatjss](https://patchblox.com/security/data/product/linux/tomcatjss.md) | ol 8 | 0:7.5.0-1.module+el8.3.0+7857+983338ee | | [velocity](https://patchblox.com/security/data/product/linux/velocity.md) | ol 8 | 0:1.7-24.module+el8.3.0+7697+44932688 | | [xalan-j2](https://patchblox.com/security/data/product/linux/xalan-j2.md) | ol 8 | 0:2.7.1-38.module+el8.3.0+7697+44932688 | | [xerces-j2](https://patchblox.com/security/data/product/linux/xerces-j2.md) | ol 8 | 0:2.11.0-34.module+el8.3.0+7697+44932688 | | [xml-commons-apis](https://patchblox.com/security/data/product/linux/xml-commons-apis.md) | ol 8 | 0:1.4.01-25.module+el8.3.0+7697+44932688 | | [xml-commons-resolver](https://patchblox.com/security/data/product/linux/xml-commons-resolver.md) | ol 8 | 0:1.2-26.module+el8.3.0+7697+44932688 | | [xmlstreambuffer](https://patchblox.com/security/data/product/linux/xmlstreambuffer.md) | ol 8 | 0:1.5.4-8.module+el8.3.0+7697+44932688 | | [xsom](https://patchblox.com/security/data/product/linux/xsom.md) | ol 8 | 0:0-19.20110809svn.module+el8.3.0+7697+44932688 | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2020-11023](https://patchblox.com/security/data/cve/CVE-2020-11023.md) | Patch now | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 6.1 | 0.8489 | CISA KEV | | [CVE-2020-11022](https://patchblox.com/security/data/cve/CVE-2020-11022.md) | Routine | libjs-jquery: In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to... | 6.1 | 0.9922 | | | [CVE-2019-11358](https://patchblox.com/security/data/cve/CVE-2019-11358.md) | Routine | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 6.1 | 0.8682 | | | [CVE-2015-9251](https://patchblox.com/security/data/cve/CVE-2015-9251.md) | Routine | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 6.1 | 0.2973 | | | [CVE-2019-8331](https://patchblox.com/security/data/cve/CVE-2019-8331.md) | Routine | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 6.1 | 0.1640 | | | [CVE-2018-14040](https://patchblox.com/security/data/cve/CVE-2018-14040.md) | Routine | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 6.1 | 0.0414 | | | [CVE-2016-10735](https://patchblox.com/security/data/cve/CVE-2016-10735.md) | Routine | fonts-glyphicons-halflings: In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS ispossible in the data-target attribute, a differ... | 6.1 | 0.0404 | | | [CVE-2018-14042](https://patchblox.com/security/data/cve/CVE-2018-14042.md) | Routine | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 6.1 | 0.0401 | | | [CVE-2019-10221](https://patchblox.com/security/data/cve/CVE-2019-10221.md) | Routine | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 6.1 | 0.0132 | | | [CVE-2020-15720](https://patchblox.com/security/data/cve/CVE-2020-15720.md) | Routine | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 6.8 | 0.0098 | | | [CVE-2020-1721](https://patchblox.com/security/data/cve/CVE-2020-1721.md) | Routine | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 6.1 | 0.0098 | | | [CVE-2019-10179](https://patchblox.com/security/data/cve/CVE-2019-10179.md) | Routine | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 6.1 | 0.0094 | | | [CVE-2019-10146](https://patchblox.com/security/data/cve/CVE-2019-10146.md) | Routine | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 4.7 | 0.0068 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo