Linux · Security advisory · November 10, 2020

ELSA-2020-4847: Security update for 47 packages

ELSA-2020-4847, released November 10, 2020, fixes 13 CVEs across 47 products. One of them is being exploited (CVE-2020-11023); 1 on CISA KEV. Patch Radar priority: Patch now.

Patch now1 on CISA KEV
CVEs closed
13
None rated Critical
Exploited
1
CVE-2020-11023
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.9922
99th percentile

Priority of the 13 CVEs

Patch now 1 Urgent 0 High 0 Routine 12

Fixed package versions

ProductReleaseFixed in
apache-commons-collectionsol 80:3.2.2-10.module+el8.3.0+7697+44932688
apache-commons-langol 80:2.6-21.module+el8.3.0+7697+44932688
apache-commons-netol 80:3.6-3.module+el8.3.0+7697+44932688
bea-stax-apiol 80:1.2.0-16.module+el8.3.0+7697+44932688
glassfish-fastinfosetol 80:1.2.13-9.module+el8.3.0+7697+44932688
glassfish-jaxb-apiol 80:2.2.12-8.module+el8.3.0+7697+44932688
glassfish-jaxb-coreol 80:2.2.11-11.module+el8.3.0+7697+44932688
glassfish-jaxb-runtimeol 80:2.2.11-11.module+el8.3.0+7697+44932688
glassfish-jaxb-txw2ol 80:2.2.11-11.module+el8.3.0+7697+44932688
jackson-annotationsol 80:2.10.0-1.module+el8.3.0+7697+44932688
jackson-coreol 80:2.10.0-1.module+el8.3.0+7697+44932688
jackson-databindol 80:2.10.0-1.module+el8.3.0+7697+44932688
jackson-jaxrs-json-providerol 80:2.9.9-1.module+el8.3.0+7697+44932688
jackson-jaxrs-providersol 80:2.9.9-1.module+el8.3.0+7697+44932688
jackson-module-jaxb-annotationsol 80:2.7.6-4.module+el8.3.0+7697+44932688
jakarta-commons-httpclientol 81:3.1-28.module+el8.3.0+7697+44932688
javassistol 80:3.18.1-8.module+el8.3.0+7697+44932688
javassist-javadocol 80:3.18.1-8.module+el8.3.0+7697+44932688
jssol 80:4.7.3-1.module+el8.3.0+7857+983338ee
jss-javadocol 80:4.7.3-1.module+el8.3.0+7857+983338ee
ldapjdkol 80:4.22.0-1.module+el8.3.0+7857+983338ee
ldapjdk-javadocol 80:4.22.0-1.module+el8.3.0+7857+983338ee
pki-baseol 80:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
pki-base-javaol 80:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
pki-caol 80:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
pki-kraol 80:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
pki-serverol 80:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
pki-servlet-4.0-apiol 81:9.0.30-1.module+el8.3.0+7697+44932688
pki-servlet-engineol 81:9.0.30-1.module+el8.3.0+7697+44932688
pki-symkeyol 80:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
pki-toolsol 80:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
python-nss-docol 80:1.0.1-10.module+el8.3.0+7697+44932688
python3-nssol 80:1.0.1-10.module+el8.3.0+7697+44932688
python3-pkiol 80:10.9.4-1.0.1.module+el8.3.0+7857+983338ee
relaxngDatatypeol 80:2011.1-7.module+el8.3.0+7697+44932688
resteasyol 80:3.0.26-3.module+el8.3.0+7697+44932688
slf4jol 80:1.7.25-4.module+el8.3.0+7697+44932688
slf4j-jdk14ol 80:1.7.25-4.module+el8.3.0+7697+44932688
stax-exol 80:1.7.7-8.module+el8.3.0+7697+44932688
tomcatjssol 80:7.5.0-1.module+el8.3.0+7857+983338ee
velocityol 80:1.7-24.module+el8.3.0+7697+44932688
xalan-j2ol 80:2.7.1-38.module+el8.3.0+7697+44932688
xerces-j2ol 80:2.11.0-34.module+el8.3.0+7697+44932688
xml-commons-apisol 80:1.4.01-25.module+el8.3.0+7697+44932688
xml-commons-resolverol 80:1.2-26.module+el8.3.0+7697+44932688
xmlstreambufferol 80:1.5.4-8.module+el8.3.0+7697+44932688
xsomol 80:0-19.20110809svn.module+el8.3.0+7697+44932688

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
Patch now CVE-2020-11023 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 6.1 0.8489 KEVExploited
Routine CVE-2020-11022 libjs-jquery: In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to... 6.1 0.9922 None reported
Routine CVE-2019-11358 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 6.1 0.8682 None reported
Routine CVE-2015-9251 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 6.1 0.2973 None reported
Routine CVE-2019-8331 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 6.1 0.1640 None reported
Routine CVE-2018-14040 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 6.1 0.0414 None reported
Routine CVE-2016-10735 fonts-glyphicons-halflings: In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS ispossible in the data-target attribute, a differ... 6.1 0.0404 None reported
Routine CVE-2018-14042 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 6.1 0.0401 None reported
Routine CVE-2019-10221 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 6.1 0.0132 None reported
Routine CVE-2020-15720 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 6.8 0.0098 None reported
Routine CVE-2020-1721 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 6.1 0.0098 None reported
Routine CVE-2019-10179 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 6.1 0.0094 None reported
Routine CVE-2019-10146 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 4.7 0.0068 None reported
Showing 1 to 13 of 13 1