Linux · Security advisory · June 18, 2019

RHSA-2019:1529: Security update for 33 packages

RHSA-2019:1529, released June 18, 2019, fixes 4 CVEs across 33 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.9768
99th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 3 Routine 1

Fixed package versions

ProductReleaseFixed in
apache-commons-collectionsRHEL 80:3.2.2-10.module+el8.0.0+3248+9d514f3b
apache-commons-langRHEL 80:2.6-21.module+el8.0.0+3248+9d514f3b
bea-stax-apiRHEL 80:1.2.0-16.module+el8.0.0+3248+9d514f3b
glassfish-fastinfosetRHEL 80:1.2.13-9.module+el8.0.0+3248+9d514f3b
glassfish-jaxb-apiRHEL 80:2.2.12-8.module+el8.0.0+3248+9d514f3b
glassfish-jaxb-coreRHEL 80:2.2.11-11.module+el8.0.0+3248+9d514f3b
glassfish-jaxb-runtimeRHEL 80:2.2.11-11.module+el8.0.0+3248+9d514f3b
glassfish-jaxb-txw2RHEL 80:2.2.11-11.module+el8.0.0+3248+9d514f3b
jackson-annotationsRHEL 80:2.9.8-1.module+el8.0.0+3248+9d514f3b
jackson-coreRHEL 80:2.9.8-1.module+el8.0.0+3248+9d514f3b
jackson-databindRHEL 80:2.9.8-1.module+el8.0.0+3248+9d514f3b
jackson-jaxrs-json-providerRHEL 80:2.9.8-1.module+el8.0.0+3248+9d514f3b
jackson-jaxrs-providersRHEL 80:2.9.8-1.module+el8.0.0+3248+9d514f3b
jackson-module-jaxb-annotationsRHEL 80:2.7.6-4.module+el8.0.0+3248+9d514f3b
jakarta-commons-httpclientRHEL 81:3.1-28.module+el8.0.0+3248+9d514f3b
javassistRHEL 80:3.18.1-8.module+el8.0.0+3248+9d514f3b
javassist-javadocRHEL 80:3.18.1-8.module+el8.0.0+3248+9d514f3b
pki-servlet-4.0-apiRHEL 81:9.0.7-14.module+el8.0.0+3248+9d514f3b
pki-servlet-containerRHEL 81:9.0.7-14.module+el8.0.0+3248+9d514f3b
python-nss-docRHEL 80:1.0.1-10.module+el8.0.0+3248+9d514f3b
python3-nssRHEL 80:1.0.1-10.module+el8.0.0+3248+9d514f3b
relaxngDatatypeRHEL 80:2011.1-7.module+el8.0.0+3248+9d514f3b
resteasyRHEL 80:3.0.26-3.module+el8.0.0+3248+9d514f3b
slf4jRHEL 80:1.7.25-4.module+el8.0.0+3248+9d514f3b
slf4j-jdk14RHEL 80:1.7.25-4.module+el8.0.0+3248+9d514f3b
stax-exRHEL 80:1.7.7-8.module+el8.0.0+3248+9d514f3b
velocityRHEL 80:1.7-24.module+el8.0.0+3248+9d514f3b
xalan-j2RHEL 80:2.7.1-38.module+el8.0.0+3248+9d514f3b
xerces-j2RHEL 80:2.11.0-34.module+el8.0.0+3248+9d514f3b
xml-commons-apisRHEL 80:1.4.01-25.module+el8.0.0+3248+9d514f3b
xml-commons-resolverRHEL 80:1.2-26.module+el8.0.0+3248+9d514f3b
xmlstreambufferRHEL 80:1.5.4-8.module+el8.0.0+3248+9d514f3b
xsomRHEL 80:0-19.20110809svn.module+el8.0.0+3248+9d514f3b

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2018-8034 pki-servlet-4.0-api: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co... 7.5 0.2105 None reported
High CVE-2018-8014 apache-commons-collections: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co... 9.8 0.2094 None reported
High CVE-2018-8037 apache-commons-collections: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co... 9.1 0.1116 None reported
Routine CVE-2018-11784 apache-commons-collections: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co... 5.3 0.9768 None reported
Showing 1 to 4 of 4 1