Linux · Oracle Linux · Security advisory · May 5, 2020

ELSA-2020-1644: Security update for 46 packages

ELSA-2020-1644, released May 5, 2020, fixes 5 CVEs across 46 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
5
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.1076
95th percentile

Priority of the 5 CVEs

Patch now 0 Urgent 0 High 5 Routine 0

Fixed package versions

ProductReleaseFixed in
apache-commons-collectionsol 80:3.2.2-10.module+el8.2.0+5508+146760da
apache-commons-langol 80:2.6-21.module+el8.2.0+5508+146760da
bea-stax-apiol 80:1.2.0-16.module+el8.2.0+5508+146760da
glassfish-fastinfosetol 80:1.2.13-9.module+el8.2.0+5508+146760da
glassfish-jaxb-apiol 80:2.2.12-8.module+el8.2.0+5508+146760da
glassfish-jaxb-coreol 80:2.2.11-11.module+el8.2.0+5508+146760da
glassfish-jaxb-runtimeol 80:2.2.11-11.module+el8.2.0+5508+146760da
glassfish-jaxb-txw2ol 80:2.2.11-11.module+el8.2.0+5508+146760da
jackson-annotationsol 80:2.10.0-1.module+el8.2.0+5508+146760da
jackson-coreol 80:2.10.0-1.module+el8.2.0+5508+146760da
jackson-databindol 80:2.10.0-1.module+el8.2.0+5508+146760da
jackson-jaxrs-json-providerol 80:2.9.9-1.module+el8.2.0+5508+146760da
jackson-jaxrs-providersol 80:2.9.9-1.module+el8.2.0+5508+146760da
jackson-module-jaxb-annotationsol 80:2.7.6-4.module+el8.2.0+5508+146760da
jakarta-commons-httpclientol 81:3.1-28.module+el8.2.0+5508+146760da
javassistol 80:3.18.1-8.module+el8.2.0+5508+146760da
javassist-javadocol 80:3.18.1-8.module+el8.2.0+5508+146760da
jssol 80:4.6.2-4.module+el8.2.0+5594+09d37207
jss-javadocol 80:4.6.2-4.module+el8.2.0+5594+09d37207
ldapjdkol 80:4.21.0-2.module+el8.2.0+5594+09d37207
ldapjdk-javadocol 80:4.21.0-2.module+el8.2.0+5594+09d37207
pki-baseol 80:10.8.3-1.0.1.module+el8.2.0+5594+09d37207
pki-base-javaol 80:10.8.3-1.0.1.module+el8.2.0+5594+09d37207
pki-caol 80:10.8.3-1.0.1.module+el8.2.0+5594+09d37207
pki-kraol 80:10.8.3-1.0.1.module+el8.2.0+5594+09d37207
pki-serverol 80:10.8.3-1.0.1.module+el8.2.0+5594+09d37207
pki-servlet-4.0-apiol 81:9.0.7-16.module+el8.2.0+5508+146760da
pki-servlet-engineol 81:9.0.7-16.module+el8.2.0+5508+146760da
pki-symkeyol 80:10.8.3-1.0.1.module+el8.2.0+5594+09d37207
pki-toolsol 80:10.8.3-1.0.1.module+el8.2.0+5594+09d37207
python-nss-docol 80:1.0.1-10.module+el8.2.0+5508+146760da
python3-nssol 80:1.0.1-10.module+el8.2.0+5508+146760da
python3-pkiol 80:10.8.3-1.0.1.module+el8.2.0+5594+09d37207
relaxngDatatypeol 80:2011.1-7.module+el8.2.0+5508+146760da
resteasyol 80:3.0.26-3.module+el8.2.0+5508+146760da
slf4jol 80:1.7.25-4.module+el8.2.0+5508+146760da
slf4j-jdk14ol 80:1.7.25-4.module+el8.2.0+5508+146760da
stax-exol 80:1.7.7-8.module+el8.2.0+5508+146760da
tomcatjssol 80:7.4.1-2.module+el8.2.0+5594+09d37207
velocityol 80:1.7-24.module+el8.2.0+5508+146760da
xalan-j2ol 80:2.7.1-38.module+el8.2.0+5508+146760da
xerces-j2ol 80:2.11.0-34.module+el8.2.0+5508+146760da
xml-commons-apisol 80:1.4.01-25.module+el8.2.0+5508+146760da
xml-commons-resolverol 80:1.2-26.module+el8.2.0+5508+146760da
xmlstreambufferol 80:1.5.4-8.module+el8.2.0+5508+146760da
xsomol 80:0-19.20110809svn.module+el8.2.0+5508+146760da

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2019-14540 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...9.8 0.1076 None reported
High CVE-2019-16942 pki-tools: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...9.8 0.0568 None reported
High CVE-2019-17531 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...9.8 0.0537 None reported
High CVE-2019-16335 python-nss-doc: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...9.8 0.0492 None reported
High CVE-2019-16943 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...9.8 0.0474 None reported
Showing 1 to 5 of 5 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.