Linux · Security advisory · August 22, 2025

ELSA-2025-14126: Security update for 34 packages

ELSA-2025-14126, released August 22, 2025, fixes 1 CVE across 34 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
1
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.0077
55th percentile

Fixed package versions

ProductReleaseFixed in
apache-commons-collectionsol 80:3.2.2-10.module+el8.10.0+90642+1ede0e5a
apache-commons-langol 80:2.6-21.module+el8.10.0+90642+1ede0e5a
apache-commons-netol 80:3.6-3.module+el8.10.0+90642+1ede0e5a
bea-stax-apiol 80:1.2.0-16.module+el8.10.0+90642+1ede0e5a
fasterxml-oss-parentol 80:69-1.module+el8.10.0+90642+1ede0e5a
glassfish-fastinfosetol 80:1.2.13-9.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-apiol 80:2.2.12-8.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-coreol 80:2.2.11-12.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-runtimeol 80:2.2.11-12.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-txw2ol 80:2.2.11-12.module+el8.10.0+90642+1ede0e5a
jackson-annotationsol 80:2.19.1-1.module+el8.10.0+90642+1ede0e5a
jackson-bomol 80:2.19.1-1.module+el8.10.0+90642+1ede0e5a
jackson-coreol 80:2.19.1-1.module+el8.10.0+90642+1ede0e5a
jackson-databindol 80:2.19.1-1.module+el8.10.0+90642+1ede0e5a
jackson-jaxrs-json-providerol 80:2.19.1-1.module+el8.10.0+90642+1ede0e5a
jackson-jaxrs-providersol 80:2.19.1-1.module+el8.10.0+90642+1ede0e5a
jackson-module-jaxb-annotationsol 80:2.19.1-1.module+el8.10.0+90642+1ede0e5a
jackson-modules-baseol 80:2.19.1-1.module+el8.10.0+90642+1ede0e5a
jackson-parentol 80:2.19.1-1.module+el8.10.0+90642+1ede0e5a
jakarta-commons-httpclientol 81:3.1-28.module+el8.10.0+90642+1ede0e5a
javassistol 80:3.18.1-8.module+el8.10.0+90642+1ede0e5a
javassist-javadocol 80:3.18.1-8.module+el8.10.0+90642+1ede0e5a
pki-servlet-engineol 81:9.0.62-1.module+el8.10.0+90642+1ede0e5a
relaxngDatatypeol 80:2011.1-7.module+el8.10.0+90642+1ede0e5a
slf4jol 80:1.7.25-4.module+el8.10.0+90642+1ede0e5a
slf4j-jdk14ol 80:1.7.25-4.module+el8.10.0+90642+1ede0e5a
stax-exol 80:1.7.7-8.module+el8.10.0+90642+1ede0e5a
velocityol 80:1.7-24.module+el8.10.0+90642+1ede0e5a
xalan-j2ol 80:2.7.1-38.module+el8.10.0+90642+1ede0e5a
xerces-j2ol 80:2.11.0-34.module+el8.10.0+90642+1ede0e5a
xml-commons-apisol 80:1.4.01-25.module+el8.10.0+90642+1ede0e5a
xml-commons-resolverol 80:1.2-26.module+el8.10.0+90642+1ede0e5a
xmlstreambufferol 80:1.5.4-8.module+el8.10.0+90642+1ede0e5a
xsomol 80:0-19.20110809svn.module+el8.10.0+90642+1ede0e5a

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2025-52999 apache-commons-lang: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 7.5 0.0077 None reported
Showing 1 to 1 of 1 1