Linux · Security advisory · July 30, 2019

ELSA-2019-1529: Security update for 33 packages

ELSA-2019-1529, released July 30, 2019, fixes 4 CVEs across 33 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.9768
99th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 3 Routine 1

Fixed package versions

ProductReleaseFixed in
apache-commons-collectionsol 80:3.2.2-10.module+el8.0.0+5231+3e842911
apache-commons-langol 80:2.6-21.module+el8.0.0+5231+3e842911
bea-stax-apiol 80:1.2.0-16.module+el8.0.0+5231+3e842911
glassfish-fastinfosetol 80:1.2.13-9.module+el8.0.0+5231+3e842911
glassfish-jaxb-apiol 80:2.2.12-8.module+el8.0.0+5231+3e842911
glassfish-jaxb-coreol 80:2.2.11-11.module+el8.0.0+5231+3e842911
glassfish-jaxb-runtimeol 80:2.2.11-11.module+el8.0.0+5231+3e842911
glassfish-jaxb-txw2ol 80:2.2.11-11.module+el8.0.0+5231+3e842911
jackson-annotationsol 80:2.9.8-1.module+el8.0.0+5231+3e842911
jackson-coreol 80:2.9.8-1.module+el8.0.0+5231+3e842911
jackson-databindol 80:2.9.8-1.module+el8.0.0+5231+3e842911
jackson-jaxrs-json-providerol 80:2.9.8-1.module+el8.0.0+5231+3e842911
jackson-jaxrs-providersol 80:2.9.8-1.module+el8.0.0+5231+3e842911
jackson-module-jaxb-annotationsol 80:2.7.6-4.module+el8.0.0+5231+3e842911
jakarta-commons-httpclientol 81:3.1-28.module+el8.0.0+5231+3e842911
javassistol 80:3.18.1-8.module+el8.0.0+5231+3e842911
javassist-javadocol 80:3.18.1-8.module+el8.0.0+5231+3e842911
pki-servlet-4.0-apiol 81:9.0.7-14.module+el8.0.0+5231+3e842911
pki-servlet-containerol 81:9.0.7-14.module+el8.0.0+5231+3e842911
python-nss-docol 80:1.0.1-10.module+el8.0.0+5231+3e842911
python3-nssol 80:1.0.1-10.module+el8.0.0+5231+3e842911
relaxngDatatypeol 80:2011.1-7.module+el8.0.0+5231+3e842911
resteasyol 80:3.0.26-3.module+el8.0.0+5231+3e842911
slf4jol 80:1.7.25-4.module+el8.0.0+5231+3e842911
slf4j-jdk14ol 80:1.7.25-4.module+el8.0.0+5231+3e842911
stax-exol 80:1.7.7-8.module+el8.0.0+5231+3e842911
velocityol 80:1.7-24.module+el8.0.0+5231+3e842911
xalan-j2ol 80:2.7.1-38.module+el8.0.0+5231+3e842911
xerces-j2ol 80:2.11.0-34.module+el8.0.0+5231+3e842911
xml-commons-apisol 80:1.4.01-25.module+el8.0.0+5231+3e842911
xml-commons-resolverol 80:1.2-26.module+el8.0.0+5231+3e842911
xmlstreambufferol 80:1.5.4-8.module+el8.0.0+5231+3e842911
xsomol 80:0-19.20110809svn.module+el8.0.0+5231+3e842911

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2018-8034 pki-servlet-4.0-api: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co... 7.5 0.2105 None reported
High CVE-2018-8014 apache-commons-collections: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co... 9.8 0.2094 None reported
High CVE-2018-8037 apache-commons-collections: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co... 9.1 0.1116 None reported
Routine CVE-2018-11784 apache-commons-collections: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co... 5.3 0.9768 None reported
Showing 1 to 4 of 4 1