Linux · Security advisory · April 28, 2020

RHSA-2020:1644: Security update for 46 packages

RHSA-2020:1644, released April 28, 2020, fixes 12 CVEs across 46 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
12
None rated Critical
Exploited
0
None reported
Exploitation more likely
0
Vendor assessment
Highest EPSS
0.2659
98th percentile

Priority of the 12 CVEs

Patch now 0 Urgent 0 High 12 Routine 0

Fixed package versions

ProductReleaseFixed in
apache-commons-collectionsRHEL 80:3.2.2-10.module+el8.1.0+3366+6dfb954c
apache-commons-langRHEL 80:2.6-21.module+el8.1.0+3366+6dfb954c
bea-stax-apiRHEL 80:1.2.0-16.module+el8.1.0+3366+6dfb954c
glassfish-fastinfosetRHEL 80:1.2.13-9.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-apiRHEL 80:2.2.12-8.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-coreRHEL 80:2.2.11-11.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-runtimeRHEL 80:2.2.11-11.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-txw2RHEL 80:2.2.11-11.module+el8.1.0+3366+6dfb954c
jackson-annotationsRHEL 80:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-coreRHEL 80:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-databindRHEL 80:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-jaxrs-json-providerRHEL 80:2.9.9-1.module+el8.1.0+3832+9784644d
jackson-jaxrs-providersRHEL 80:2.9.9-1.module+el8.1.0+3832+9784644d
jackson-module-jaxb-annotationsRHEL 80:2.7.6-4.module+el8.1.0+3366+6dfb954c
jakarta-commons-httpclientRHEL 81:3.1-28.module+el8.1.0+3366+6dfb954c
javassistRHEL 80:3.18.1-8.module+el8.1.0+3366+6dfb954c
javassist-javadocRHEL 80:3.18.1-8.module+el8.1.0+3366+6dfb954c
jssRHEL 80:4.6.2-4.module+el8.2.0+6123+b4678599
jss-javadocRHEL 80:4.6.2-4.module+el8.2.0+6123+b4678599
ldapjdkRHEL 80:4.21.0-2.module+el8.2.0+4573+c3c38c7b
ldapjdk-javadocRHEL 80:4.21.0-2.module+el8.2.0+4573+c3c38c7b
pki-baseRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-base-javaRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-caRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-kraRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-serverRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-servlet-4.0-apiRHEL 81:9.0.7-16.module+el8.1.0+3366+6dfb954c
pki-servlet-engineRHEL 81:9.0.7-16.module+el8.1.0+3366+6dfb954c
pki-symkeyRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-toolsRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
python-nss-docRHEL 80:1.0.1-10.module+el8.1.0+3366+6dfb954c
python3-nssRHEL 80:1.0.1-10.module+el8.1.0+3366+6dfb954c
python3-pkiRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
relaxngDatatypeRHEL 80:2011.1-7.module+el8.1.0+3366+6dfb954c
resteasyRHEL 80:3.0.26-3.module+el8.1.0+3366+6dfb954c
slf4jRHEL 80:1.7.25-4.module+el8.1.0+3366+6dfb954c
slf4j-jdk14RHEL 80:1.7.25-4.module+el8.1.0+3366+6dfb954c
stax-exRHEL 80:1.7.7-8.module+el8.1.0+3366+6dfb954c
tomcatjssRHEL 80:7.4.1-2.module+el8.2.0+4573+c3c38c7b
velocityRHEL 80:1.7-24.module+el8.1.0+3366+6dfb954c
xalan-j2RHEL 80:2.7.1-38.module+el8.1.0+3366+6dfb954c
xerces-j2RHEL 80:2.11.0-34.module+el8.1.0+3366+6dfb954c
xml-commons-apisRHEL 80:1.4.01-25.module+el8.1.0+3366+6dfb954c
xml-commons-resolverRHEL 80:1.2-26.module+el8.1.0+3366+6dfb954c
xmlstreambufferRHEL 80:1.5.4-8.module+el8.1.0+3366+6dfb954c
xsomRHEL 80:0-19.20110809svn.module+el8.1.0+3366+6dfb954c

CVEs this fix closes

PriorityCVETitleImpactCVSSEPSSExploitation
High CVE-2020-8840 xsom: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 8.1 0.2659 None reported
High CVE-2020-9548 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 8.1 0.1892 None reported
High CVE-2020-9547 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 8.1 0.1838 None reported
High CVE-2019-14540 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 9.8 0.1076 None reported
High CVE-2019-20330 bea-stax-api: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 8.1 0.0864 None reported
High CVE-2020-10673 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 8.1 0.0803 None reported
High CVE-2019-16942 pki-tools: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 9.8 0.0573 None reported
High CVE-2019-17531 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 9.8 0.0537 None reported
High CVE-2019-16335 python-nss-doc: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 9.8 0.0492 None reported
High CVE-2019-16943 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 9.8 0.0474 None reported
High CVE-2020-9546 pki-ca: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 8.1 0.0458 None reported
High CVE-2020-10672 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur... 8.1 0.0306 None reported
Showing 1 to 12 of 12 1