ALSA-2024:3061

See a problem?
Please try reporting it to the source first.
Source
https://errata.almalinux.org/8/ALSA-2024-3061.html
Import Source
https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux8/ALSA-2024:3061.json
JSON Data
https://api.osv.dev/v1/vulns/ALSA-2024:3061
Related
Published
2024-05-22T00:00:00Z
Modified
2024-05-29T14:51:14Z
Summary
Moderate: pki-core:10.6 and pki-deps:10.6 security update
Details

The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System.

Security Fix(es):

  • jackson-databind: denial of service via a large depth of nested objects (CVE-2020-36518)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References

Affected packages

AlmaLinux:8 / apache-commons-collections

Package

Name
apache-commons-collections
Purl
pkg:rpm/almalinux/apache-commons-collections

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.2.2-10.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / apache-commons-lang

Package

Name
apache-commons-lang
Purl
pkg:rpm/almalinux/apache-commons-lang

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.6-21.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / apache-commons-net

Package

Name
apache-commons-net
Purl
pkg:rpm/almalinux/apache-commons-net

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.6-3.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / bea-stax-api

Package

Name
bea-stax-api
Purl
pkg:rpm/almalinux/bea-stax-api

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.0-16.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / fasterxml-oss-parent

Package

Name
fasterxml-oss-parent
Purl
pkg:rpm/almalinux/fasterxml-oss-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
49-1.module_el8.10.0+3791+e0637953

AlmaLinux:8 / glassfish-fastinfoset

Package

Name
glassfish-fastinfoset
Purl
pkg:rpm/almalinux/glassfish-fastinfoset

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2.13-9.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / glassfish-jaxb-api

Package

Name
glassfish-jaxb-api
Purl
pkg:rpm/almalinux/glassfish-jaxb-api

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.12-8.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / glassfish-jaxb-core

Package

Name
glassfish-jaxb-core
Purl
pkg:rpm/almalinux/glassfish-jaxb-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.11-12.module_el8.10.0+3791+e0637953

AlmaLinux:8 / glassfish-jaxb-runtime

Package

Name
glassfish-jaxb-runtime
Purl
pkg:rpm/almalinux/glassfish-jaxb-runtime

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.11-12.module_el8.10.0+3791+e0637953

AlmaLinux:8 / glassfish-jaxb-txw2

Package

Name
glassfish-jaxb-txw2
Purl
pkg:rpm/almalinux/glassfish-jaxb-txw2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.2.11-12.module_el8.10.0+3791+e0637953

AlmaLinux:8 / jackson-annotations

Package

Name
jackson-annotations
Purl
pkg:rpm/almalinux/jackson-annotations

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14.2-1.module_el8.10.0+3791+e0637953

AlmaLinux:8 / jackson-bom

Package

Name
jackson-bom
Purl
pkg:rpm/almalinux/jackson-bom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14.2-1.module_el8.10.0+3791+e0637953

AlmaLinux:8 / jackson-core

Package

Name
jackson-core
Purl
pkg:rpm/almalinux/jackson-core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14.2-1.module_el8.10.0+3791+e0637953

AlmaLinux:8 / jackson-databind

Package

Name
jackson-databind
Purl
pkg:rpm/almalinux/jackson-databind

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14.2-1.module_el8.10.0+3791+e0637953

AlmaLinux:8 / jackson-jaxrs-json-provider

Package

Name
jackson-jaxrs-json-provider
Purl
pkg:rpm/almalinux/jackson-jaxrs-json-provider

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14.2-1.module_el8.10.0+3791+e0637953

AlmaLinux:8 / jackson-jaxrs-providers

Package

Name
jackson-jaxrs-providers
Purl
pkg:rpm/almalinux/jackson-jaxrs-providers

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14.2-1.module_el8.10.0+3791+e0637953

AlmaLinux:8 / jackson-module-jaxb-annotations

Package

Name
jackson-module-jaxb-annotations
Purl
pkg:rpm/almalinux/jackson-module-jaxb-annotations

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14.2-2.module_el8.10.0+3791+e0637953

AlmaLinux:8 / jackson-modules-base

Package

Name
jackson-modules-base
Purl
pkg:rpm/almalinux/jackson-modules-base

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14.2-2.module_el8.10.0+3791+e0637953

AlmaLinux:8 / jackson-parent

Package

Name
jackson-parent
Purl
pkg:rpm/almalinux/jackson-parent

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.14-1.module_el8.10.0+3791+e0637953

AlmaLinux:8 / jakarta-commons-httpclient

Package

Name
jakarta-commons-httpclient
Purl
pkg:rpm/almalinux/jakarta-commons-httpclient

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:3.1-28.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / javassist

Package

Name
javassist
Purl
pkg:rpm/almalinux/javassist

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.18.1-8.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / javassist-javadoc

Package

Name
javassist-javadoc
Purl
pkg:rpm/almalinux/javassist-javadoc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
3.18.1-8.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / pki-servlet-engine

Package

Name
pki-servlet-engine
Purl
pkg:rpm/almalinux/pki-servlet-engine

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1:9.0.62-1.module_el8.10.0+3791+e0637953

AlmaLinux:8 / relaxngDatatype

Package

Name
relaxngDatatype
Purl
pkg:rpm/almalinux/relaxngDatatype

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2011.1-7.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / slf4j

Package

Name
slf4j
Purl
pkg:rpm/almalinux/slf4j

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.7.25-4.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / slf4j-jdk14

Package

Name
slf4j-jdk14
Purl
pkg:rpm/almalinux/slf4j-jdk14

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.7.25-4.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / stax-ex

Package

Name
stax-ex
Purl
pkg:rpm/almalinux/stax-ex

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.7.7-8.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / velocity

Package

Name
velocity
Purl
pkg:rpm/almalinux/velocity

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.7-24.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / xalan-j2

Package

Name
xalan-j2
Purl
pkg:rpm/almalinux/xalan-j2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.7.1-38.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / xerces-j2

Package

Name
xerces-j2
Purl
pkg:rpm/almalinux/xerces-j2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.11.0-34.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / xml-commons-apis

Package

Name
xml-commons-apis
Purl
pkg:rpm/almalinux/xml-commons-apis

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.4.01-25.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / xml-commons-resolver

Package

Name
xml-commons-resolver
Purl
pkg:rpm/almalinux/xml-commons-resolver

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.2-26.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / xmlstreambuffer

Package

Name
xmlstreambuffer
Purl
pkg:rpm/almalinux/xmlstreambuffer

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.5.4-8.module_el8.5.0+2577+9e95fe00

AlmaLinux:8 / xsom

Package

Name
xsom
Purl
pkg:rpm/almalinux/xsom

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
0-19.20110809svn.module_el8.5.0+2577+9e95fe00