# RHSA-2020:1644: Security update for 46 packages RHSA-2020:1644, released April 28, 2020, fixes 12 CVEs across 46 products. None of them is reported as exploited. Patch Radar priority: High. - Web page: https://patchblox.com/security/fix/linux/rhsa-2020-1644 - Platform: Linux - Released: Apr 28, 2020 - Priority: High (Closes CVE-2020-8840, high severity) - CVEs: 12, exploited: 0, on CISA KEV: 0 - Vendor advisory: https://access.redhat.com/errata/RHSA-2020:1644 ## Applies to | Product | Release | Fixed in | |---|---|---| | [apache-commons-collections](https://patchblox.com/security/data/product/linux/apache-commons-collections.md) | RHEL 8 | 0:3.2.2-10.module+el8.1.0+3366+6dfb954c | | [apache-commons-lang](https://patchblox.com/security/data/product/linux/apache-commons-lang.md) | RHEL 8 | 0:2.6-21.module+el8.1.0+3366+6dfb954c | | [bea-stax-api](https://patchblox.com/security/data/product/linux/bea-stax-api.md) | RHEL 8 | 0:1.2.0-16.module+el8.1.0+3366+6dfb954c | | [glassfish-fastinfoset](https://patchblox.com/security/data/product/linux/glassfish-fastinfoset.md) | RHEL 8 | 0:1.2.13-9.module+el8.1.0+3366+6dfb954c | | [glassfish-jaxb-api](https://patchblox.com/security/data/product/linux/glassfish-jaxb-api.md) | RHEL 8 | 0:2.2.12-8.module+el8.1.0+3366+6dfb954c | | [glassfish-jaxb-core](https://patchblox.com/security/data/product/linux/glassfish-jaxb-core.md) | RHEL 8 | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c | | [glassfish-jaxb-runtime](https://patchblox.com/security/data/product/linux/glassfish-jaxb-runtime.md) | RHEL 8 | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c | | [glassfish-jaxb-txw2](https://patchblox.com/security/data/product/linux/glassfish-jaxb-txw2.md) | RHEL 8 | 0:2.2.11-11.module+el8.1.0+3366+6dfb954c | | [jackson-annotations](https://patchblox.com/security/data/product/linux/jackson-annotations.md) | RHEL 8 | 0:2.10.0-1.module+el8.2.0+5059+3eb3af25 | | [jackson-core](https://patchblox.com/security/data/product/linux/jackson-core.md) | RHEL 8 | 0:2.10.0-1.module+el8.2.0+5059+3eb3af25 | | [jackson-databind](https://patchblox.com/security/data/product/linux/jackson-databind.md) | RHEL 8 | 0:2.10.0-1.module+el8.2.0+5059+3eb3af25 | | [jackson-jaxrs-json-provider](https://patchblox.com/security/data/product/linux/jackson-jaxrs-json-provider.md) | RHEL 8 | 0:2.9.9-1.module+el8.1.0+3832+9784644d | | [jackson-jaxrs-providers](https://patchblox.com/security/data/product/linux/jackson-jaxrs-providers.md) | RHEL 8 | 0:2.9.9-1.module+el8.1.0+3832+9784644d | | [jackson-module-jaxb-annotations](https://patchblox.com/security/data/product/linux/jackson-module-jaxb-annotations.md) | RHEL 8 | 0:2.7.6-4.module+el8.1.0+3366+6dfb954c | | [jakarta-commons-httpclient](https://patchblox.com/security/data/product/linux/jakarta-commons-httpclient.md) | RHEL 8 | 1:3.1-28.module+el8.1.0+3366+6dfb954c | | [javassist](https://patchblox.com/security/data/product/linux/javassist.md) | RHEL 8 | 0:3.18.1-8.module+el8.1.0+3366+6dfb954c | | [javassist-javadoc](https://patchblox.com/security/data/product/linux/javassist-javadoc.md) | RHEL 8 | 0:3.18.1-8.module+el8.1.0+3366+6dfb954c | | [jss](https://patchblox.com/security/data/product/linux/jss.md) | RHEL 8 | 0:4.6.2-4.module+el8.2.0+6123+b4678599 | | [jss-javadoc](https://patchblox.com/security/data/product/linux/jss-javadoc.md) | RHEL 8 | 0:4.6.2-4.module+el8.2.0+6123+b4678599 | | [ldapjdk](https://patchblox.com/security/data/product/linux/ldapjdk.md) | RHEL 8 | 0:4.21.0-2.module+el8.2.0+4573+c3c38c7b | | [ldapjdk-javadoc](https://patchblox.com/security/data/product/linux/ldapjdk-javadoc.md) | RHEL 8 | 0:4.21.0-2.module+el8.2.0+4573+c3c38c7b | | [pki-base](https://patchblox.com/security/data/product/linux/pki-base.md) | RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | | [pki-base-java](https://patchblox.com/security/data/product/linux/pki-base-java.md) | RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | | [pki-ca](https://patchblox.com/security/data/product/linux/pki-ca.md) | RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | | [pki-kra](https://patchblox.com/security/data/product/linux/pki-kra.md) | RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | | [pki-server](https://patchblox.com/security/data/product/linux/pki-server.md) | RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | | [pki-servlet-4.0-api](https://patchblox.com/security/data/product/linux/pki-servlet-4.0-api.md) | RHEL 8 | 1:9.0.7-16.module+el8.1.0+3366+6dfb954c | | [pki-servlet-engine](https://patchblox.com/security/data/product/linux/pki-servlet-engine.md) | RHEL 8 | 1:9.0.7-16.module+el8.1.0+3366+6dfb954c | | [pki-symkey](https://patchblox.com/security/data/product/linux/pki-symkey.md) | RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | | [pki-tools](https://patchblox.com/security/data/product/linux/pki-tools.md) | RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | | [python-nss-doc](https://patchblox.com/security/data/product/linux/python-nss-doc.md) | RHEL 8 | 0:1.0.1-10.module+el8.1.0+3366+6dfb954c | | [python3-nss](https://patchblox.com/security/data/product/linux/python3-nss.md) | RHEL 8 | 0:1.0.1-10.module+el8.1.0+3366+6dfb954c | | [python3-pki](https://patchblox.com/security/data/product/linux/python3-pki.md) | RHEL 8 | 0:10.8.3-1.module+el8.2.0+5925+bad5981a | | [relaxngDatatype](https://patchblox.com/security/data/product/linux/relaxngdatatype.md) | RHEL 8 | 0:2011.1-7.module+el8.1.0+3366+6dfb954c | | [resteasy](https://patchblox.com/security/data/product/linux/resteasy.md) | RHEL 8 | 0:3.0.26-3.module+el8.1.0+3366+6dfb954c | | [slf4j](https://patchblox.com/security/data/product/linux/slf4j.md) | RHEL 8 | 0:1.7.25-4.module+el8.1.0+3366+6dfb954c | | [slf4j-jdk14](https://patchblox.com/security/data/product/linux/slf4j-jdk14.md) | RHEL 8 | 0:1.7.25-4.module+el8.1.0+3366+6dfb954c | | [stax-ex](https://patchblox.com/security/data/product/linux/stax-ex.md) | RHEL 8 | 0:1.7.7-8.module+el8.1.0+3366+6dfb954c | | [tomcatjss](https://patchblox.com/security/data/product/linux/tomcatjss.md) | RHEL 8 | 0:7.4.1-2.module+el8.2.0+4573+c3c38c7b | | [velocity](https://patchblox.com/security/data/product/linux/velocity.md) | RHEL 8 | 0:1.7-24.module+el8.1.0+3366+6dfb954c | | [xalan-j2](https://patchblox.com/security/data/product/linux/xalan-j2.md) | RHEL 8 | 0:2.7.1-38.module+el8.1.0+3366+6dfb954c | | [xerces-j2](https://patchblox.com/security/data/product/linux/xerces-j2.md) | RHEL 8 | 0:2.11.0-34.module+el8.1.0+3366+6dfb954c | | [xml-commons-apis](https://patchblox.com/security/data/product/linux/xml-commons-apis.md) | RHEL 8 | 0:1.4.01-25.module+el8.1.0+3366+6dfb954c | | [xml-commons-resolver](https://patchblox.com/security/data/product/linux/xml-commons-resolver.md) | RHEL 8 | 0:1.2-26.module+el8.1.0+3366+6dfb954c | | [xmlstreambuffer](https://patchblox.com/security/data/product/linux/xmlstreambuffer.md) | RHEL 8 | 0:1.5.4-8.module+el8.1.0+3366+6dfb954c | | [xsom](https://patchblox.com/security/data/product/linux/xsom.md) | RHEL 8 | 0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c | ## CVEs this fix closes | CVE | Priority | Title | CVSS | EPSS | Exploitation | |---|---|---|---:|---:|---| | [CVE-2020-8840](https://patchblox.com/security/data/cve/CVE-2020-8840.md) | High | xsom: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 8.1 | 0.2659 | | | [CVE-2020-9548](https://patchblox.com/security/data/cve/CVE-2020-9548.md) | High | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 8.1 | 0.1892 | | | [CVE-2020-9547](https://patchblox.com/security/data/cve/CVE-2020-9547.md) | High | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 8.1 | 0.1838 | | | [CVE-2019-14540](https://patchblox.com/security/data/cve/CVE-2019-14540.md) | High | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 9.8 | 0.1076 | | | [CVE-2019-20330](https://patchblox.com/security/data/cve/CVE-2019-20330.md) | High | bea-stax-api: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 8.1 | 0.0864 | | | [CVE-2020-10673](https://patchblox.com/security/data/cve/CVE-2020-10673.md) | High | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 8.1 | 0.0803 | | | [CVE-2019-16942](https://patchblox.com/security/data/cve/CVE-2019-16942.md) | High | pki-tools: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 9.8 | 0.0573 | | | [CVE-2019-17531](https://patchblox.com/security/data/cve/CVE-2019-17531.md) | High | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 9.8 | 0.0537 | | | [CVE-2019-16335](https://patchblox.com/security/data/cve/CVE-2019-16335.md) | High | python-nss-doc: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 9.8 | 0.0492 | | | [CVE-2019-16943](https://patchblox.com/security/data/cve/CVE-2019-16943.md) | High | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 9.8 | 0.0474 | | | [CVE-2020-9546](https://patchblox.com/security/data/cve/CVE-2020-9546.md) | High | pki-ca: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 8.1 | 0.0458 | | | [CVE-2020-10672](https://patchblox.com/security/data/cve/CVE-2020-10672.md) | High | apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... | 8.1 | 0.0306 | | --- Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo