RLSA-2020:1644
See a problem?- Import Source
- https://storage.googleapis.com/resf-osv-data/RLSA-2020:1644.json
- JSON Data
- https://api.osv.dev/v1/vulns/RLSA-2020:1644
- Related
- Published
- 2020-04-28T09:00:20Z
- Modified
- 2023-02-02T13:04:12.875880Z
- Severity
-
- 8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
- Summary
- Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
- Details
-
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Rocky Enterprise Software Foundation Certificate System.
Security Fix(es):
jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig (CVE-2019-14540)
jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource (CVE-2019-16335)
jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* (CVE-2019-16942)
jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource (CVE-2019-16943)
jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* (CVE-2019-17531)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 8.2 Release Notes linked from the References section.
- References
-
- https://errata.rockylinux.org/RLSA-2020:1644
- https://bugzilla.redhat.com/show_bug.cgi?id=1535313
- https://bugzilla.redhat.com/show_bug.cgi?id=1655438
- https://bugzilla.redhat.com/show_bug.cgi?id=1656786
- https://bugzilla.redhat.com/show_bug.cgi?id=1698084
- https://bugzilla.redhat.com/show_bug.cgi?id=1744095
- https://bugzilla.redhat.com/show_bug.cgi?id=1755831
- https://bugzilla.redhat.com/show_bug.cgi?id=1755849
- https://bugzilla.redhat.com/show_bug.cgi?id=1758187
- https://bugzilla.redhat.com/show_bug.cgi?id=1758191
- https://bugzilla.redhat.com/show_bug.cgi?id=1767125
- https://bugzilla.redhat.com/show_bug.cgi?id=1767131
- https://bugzilla.redhat.com/show_bug.cgi?id=1775293
- https://bugzilla.redhat.com/show_bug.cgi?id=1777032
- https://bugzilla.redhat.com/show_bug.cgi?id=1782486
- https://bugzilla.redhat.com/show_bug.cgi?id=1795215
- https://bugzilla.redhat.com/show_bug.cgi?id=1802006
- https://bugzilla.redhat.com/show_bug.cgi?id=1806840
- https://bugzilla.redhat.com/show_bug.cgi?id=1807371
- https://bugzilla.redhat.com/show_bug.cgi?id=1807421
- https://bugzilla.redhat.com/show_bug.cgi?id=1809210
- Credits
-
-
- Rocky Enterprise Software Foundation
-
- Red Hat
-
Affected packages
Rocky Linux:8 / apache-commons-collections
Package
- Name
- apache-commons-collections
- Purl
- pkg:rpm/rocky-linux/apache-commons-collections?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / apache-commons-collections
Package
- Name
- apache-commons-collections
- Purl
- pkg:rpm/rocky-linux/apache-commons-collections?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / apache-commons-lang
Package
- Name
- apache-commons-lang
- Purl
- pkg:rpm/rocky-linux/apache-commons-lang?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / apache-commons-lang
Package
- Name
- apache-commons-lang
- Purl
- pkg:rpm/rocky-linux/apache-commons-lang?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / bea-stax
Package
- Name
- bea-stax
- Purl
- pkg:rpm/rocky-linux/bea-stax?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / glassfish-fastinfoset
Package
- Name
- glassfish-fastinfoset
- Purl
- pkg:rpm/rocky-linux/glassfish-fastinfoset?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / glassfish-jaxb
Package
- Name
- glassfish-jaxb
- Purl
- pkg:rpm/rocky-linux/glassfish-jaxb?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / glassfish-jaxb-api
Package
- Name
- glassfish-jaxb-api
- Purl
- pkg:rpm/rocky-linux/glassfish-jaxb-api?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / jackson-annotations
Package
- Name
- jackson-annotations
- Purl
- pkg:rpm/rocky-linux/jackson-annotations?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / jackson-core
Package
- Name
- jackson-core
- Purl
- pkg:rpm/rocky-linux/jackson-core?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / jackson-databind
Package
- Name
- jackson-databind
- Purl
- pkg:rpm/rocky-linux/jackson-databind?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / jackson-jaxrs-providers
Package
- Name
- jackson-jaxrs-providers
- Purl
- pkg:rpm/rocky-linux/jackson-jaxrs-providers?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / jackson-module-jaxb-annotations
Package
- Name
- jackson-module-jaxb-annotations
- Purl
- pkg:rpm/rocky-linux/jackson-module-jaxb-annotations?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / jakarta-commons-httpclient
Package
- Name
- jakarta-commons-httpclient
- Purl
- pkg:rpm/rocky-linux/jakarta-commons-httpclient?distro=rocky-linux-8&epoch=1
Rocky Linux:8 / jakarta-commons-httpclient
Package
- Name
- jakarta-commons-httpclient
- Purl
- pkg:rpm/rocky-linux/jakarta-commons-httpclient?distro=rocky-linux-8&epoch=1
Rocky Linux:8 / python-nss
Package
- Name
- python-nss
- Purl
- pkg:rpm/rocky-linux/python-nss?distro=rocky-linux-8-5-legacy&epoch=0
Rocky Linux:8 / javassist
Package
- Name
- javassist
- Purl
- pkg:rpm/rocky-linux/javassist?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / javassist
Package
- Name
- javassist
- Purl
- pkg:rpm/rocky-linux/javassist?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / relaxngDatatype
Package
- Name
- relaxngDatatype
- Purl
- pkg:rpm/rocky-linux/relaxngDatatype?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / resteasy
Package
- Name
- resteasy
- Purl
- pkg:rpm/rocky-linux/resteasy?distro=rocky-linux-8-4-legacy&epoch=0
Rocky Linux:8 / slf4j
Package
- Name
- slf4j
- Purl
- pkg:rpm/rocky-linux/slf4j?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / slf4j
Package
- Name
- slf4j
- Purl
- pkg:rpm/rocky-linux/slf4j?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / slf4j
Package
- Name
- slf4j
- Purl
- pkg:rpm/rocky-linux/slf4j?distro=rocky-linux-8-4-legacy&epoch=0
Rocky Linux:8 / stax-ex
Package
- Name
- stax-ex
- Purl
- pkg:rpm/rocky-linux/stax-ex?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / velocity
Package
- Name
- velocity
- Purl
- pkg:rpm/rocky-linux/velocity?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / velocity
Package
- Name
- velocity
- Purl
- pkg:rpm/rocky-linux/velocity?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / xalan-j2
Package
- Name
- xalan-j2
- Purl
- pkg:rpm/rocky-linux/xalan-j2?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / xalan-j2
Package
- Name
- xalan-j2
- Purl
- pkg:rpm/rocky-linux/xalan-j2?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / xerces-j2
Package
- Name
- xerces-j2
- Purl
- pkg:rpm/rocky-linux/xerces-j2?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / xerces-j2
Package
- Name
- xerces-j2
- Purl
- pkg:rpm/rocky-linux/xerces-j2?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / xml-commons-apis
Package
- Name
- xml-commons-apis
- Purl
- pkg:rpm/rocky-linux/xml-commons-apis?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / xml-commons-apis
Package
- Name
- xml-commons-apis
- Purl
- pkg:rpm/rocky-linux/xml-commons-apis?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / xml-commons-apis
Package
- Name
- xml-commons-apis
- Purl
- pkg:rpm/rocky-linux/xml-commons-apis?distro=rocky-linux-8-4-legacy&epoch=0
Rocky Linux:8 / xml-commons-resolver
Package
- Name
- xml-commons-resolver
- Purl
- pkg:rpm/rocky-linux/xml-commons-resolver?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / xml-commons-resolver
Package
- Name
- xml-commons-resolver
- Purl
- pkg:rpm/rocky-linux/xml-commons-resolver?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / xmlstreambuffer
Package
- Name
- xmlstreambuffer
- Purl
- pkg:rpm/rocky-linux/xmlstreambuffer?distro=rocky-linux-8&epoch=0
Rocky Linux:8 / xsom
Package
- Name
- xsom
- Purl
- pkg:rpm/rocky-linux/xsom?distro=rocky-linux-8&epoch=0