Linux · Security advisory · September 17, 2019

ELSA-2019-2720: Security update for 33 packages

ELSA-2019-2720, released September 17, 2019, fixes 1 CVE across 33 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
1
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.4521
98th percentile

Fixed package versions

ProductReleaseFixed in
apache-commons-collectionsol 80:3.2.2-10.module+el8.0.0+5332+2d497d9a
apache-commons-langol 80:2.6-21.module+el8.0.0+5332+2d497d9a
bea-stax-apiol 80:1.2.0-16.module+el8.0.0+5332+2d497d9a
glassfish-fastinfosetol 80:1.2.13-9.module+el8.0.0+5332+2d497d9a
glassfish-jaxb-apiol 80:2.2.12-8.module+el8.0.0+5332+2d497d9a
glassfish-jaxb-coreol 80:2.2.11-11.module+el8.0.0+5332+2d497d9a
glassfish-jaxb-runtimeol 80:2.2.11-11.module+el8.0.0+5332+2d497d9a
glassfish-jaxb-txw2ol 80:2.2.11-11.module+el8.0.0+5332+2d497d9a
jackson-annotationsol 80:2.9.8-1.module+el8.0.0+5332+2d497d9a
jackson-coreol 80:2.9.8-1.module+el8.0.0+5332+2d497d9a
jackson-databindol 80:2.9.8-1.module+el8.0.0+5332+2d497d9a
jackson-jaxrs-json-providerol 80:2.9.8-1.module+el8.0.0+5332+2d497d9a
jackson-jaxrs-providersol 80:2.9.8-1.module+el8.0.0+5332+2d497d9a
jackson-module-jaxb-annotationsol 80:2.7.6-4.module+el8.0.0+5332+2d497d9a
jakarta-commons-httpclientol 81:3.1-28.module+el8.0.0+5332+2d497d9a
javassistol 80:3.18.1-8.module+el8.0.0+5332+2d497d9a
javassist-javadocol 80:3.18.1-8.module+el8.0.0+5332+2d497d9a
pki-servlet-4.0-apiol 81:9.0.7-14.module+el8.0.0+5332+2d497d9a
pki-servlet-containerol 81:9.0.7-14.module+el8.0.0+5332+2d497d9a
python-nss-docol 80:1.0.1-10.module+el8.0.0+5332+2d497d9a
python3-nssol 80:1.0.1-10.module+el8.0.0+5332+2d497d9a
relaxngDatatypeol 80:2011.1-7.module+el8.0.0+5332+2d497d9a
resteasyol 80:3.0.26-3.module+el8.0.0+5332+2d497d9a
slf4jol 80:1.7.25-4.module+el8.0.0+5332+2d497d9a
slf4j-jdk14ol 80:1.7.25-4.module+el8.0.0+5332+2d497d9a
stax-exol 80:1.7.7-8.module+el8.0.0+5332+2d497d9a
velocityol 80:1.7-24.module+el8.0.0+5332+2d497d9a
xalan-j2ol 80:2.7.1-38.module+el8.0.0+5332+2d497d9a
xerces-j2ol 80:2.11.0-34.module+el8.0.0+5332+2d497d9a
xml-commons-apisol 80:1.4.01-25.module+el8.0.0+5332+2d497d9a
xml-commons-resolverol 80:1.2-26.module+el8.0.0+5332+2d497d9a
xmlstreambufferol 80:1.5.4-8.module+el8.0.0+5332+2d497d9a
xsomol 80:0-19.20110809svn.module+el8.0.0+5332+2d497d9a

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2019-12384 libjackson2-databind-java: FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to havea variety of impacts by leveraging failure... 8.1 0.4521 None reported
Showing 1 to 1 of 1 1