Skip to content
OpenAdvisories
High ELSA-2019-1529 4 CVEs

Important: pki-deps:10.6 security update (Oracle Linux 8)

Published Jul 30, 2019 · Updated Jul 30, 2019

Ecosystem: Oracle Linux

Summary

apache-commons-collections
[3.2.2-10]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

[3.2.2-9]
- Remove workaround for symlink->directory rpm bug

jackson-bom
[2.9.8-1]
- Update to latest upstream release

[2.9.4-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.9.4-1]
- Update to latest upstream release

[2.9.3-1]
- Initial packaging

pki-servlet-container
[1:9.0.7-14]
- Update to JWS 5.0.2 distribution
- Resolves: rhbz#1658846 CVE-2018-8034 pki-servlet-container: tomcat: host name verification missing in WebSocket client
- Resolves: rhbz#1579614 CVE-2018-8014 pki-servlet-container: tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
- Resolves: rhbz#1619232 - CVE-2018-8037 pki-servlet-container: tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up
- Resolves: rhbz#1641874 - CVE-2018-11784 pki-servlet-container: tomcat: Open redirect in default servlet

velocity
[0:1.7-24]
- Repack the tarball without binaries

[0:1.7-23]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

xerces-j2
[2.11.0-34]
- Fix license tag to include W3C

[2.11.0-33]
- Add requirement on javapackages-tools since scripts use
java-functions.

[2.11.0-32]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

xml-commons-resolver
[0:1.2-26]
- Add requirement on javapackages-tools since scripts use
java-functions.

[0:1.2-25]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

Fixed packages 33

ReleasePackageFixed in
Oracle Linux · 8 apache-commons-collections 0:3.2.2-10.module+el8.0.0+5231+3e842911
Oracle Linux · 8 apache-commons-lang 0:2.6-21.module+el8.0.0+5231+3e842911
Oracle Linux · 8 bea-stax-api 0:1.2.0-16.module+el8.0.0+5231+3e842911
Oracle Linux · 8 glassfish-fastinfoset 0:1.2.13-9.module+el8.0.0+5231+3e842911
Oracle Linux · 8 glassfish-jaxb-api 0:2.2.12-8.module+el8.0.0+5231+3e842911
Oracle Linux · 8 glassfish-jaxb-core 0:2.2.11-11.module+el8.0.0+5231+3e842911
Oracle Linux · 8 glassfish-jaxb-runtime 0:2.2.11-11.module+el8.0.0+5231+3e842911
Oracle Linux · 8 glassfish-jaxb-txw2 0:2.2.11-11.module+el8.0.0+5231+3e842911
Oracle Linux · 8 jackson-annotations 0:2.9.8-1.module+el8.0.0+5231+3e842911
Oracle Linux · 8 jackson-core 0:2.9.8-1.module+el8.0.0+5231+3e842911
Oracle Linux · 8 jackson-databind 0:2.9.8-1.module+el8.0.0+5231+3e842911
Oracle Linux · 8 jackson-jaxrs-json-provider 0:2.9.8-1.module+el8.0.0+5231+3e842911
Oracle Linux · 8 jackson-jaxrs-providers 0:2.9.8-1.module+el8.0.0+5231+3e842911
Oracle Linux · 8 jackson-module-jaxb-annotations 0:2.7.6-4.module+el8.0.0+5231+3e842911
Oracle Linux · 8 jakarta-commons-httpclient 1:3.1-28.module+el8.0.0+5231+3e842911
Oracle Linux · 8 javassist 0:3.18.1-8.module+el8.0.0+5231+3e842911
Oracle Linux · 8 javassist-javadoc 0:3.18.1-8.module+el8.0.0+5231+3e842911
Oracle Linux · 8 pki-servlet-4.0-api 1:9.0.7-14.module+el8.0.0+5231+3e842911
Oracle Linux · 8 pki-servlet-container 1:9.0.7-14.module+el8.0.0+5231+3e842911
Oracle Linux · 8 python-nss-doc 0:1.0.1-10.module+el8.0.0+5231+3e842911
Oracle Linux · 8 python3-nss 0:1.0.1-10.module+el8.0.0+5231+3e842911
Oracle Linux · 8 relaxngDatatype 0:2011.1-7.module+el8.0.0+5231+3e842911
Oracle Linux · 8 resteasy 0:3.0.26-3.module+el8.0.0+5231+3e842911
Oracle Linux · 8 slf4j 0:1.7.25-4.module+el8.0.0+5231+3e842911
Oracle Linux · 8 slf4j-jdk14 0:1.7.25-4.module+el8.0.0+5231+3e842911
Oracle Linux · 8 stax-ex 0:1.7.7-8.module+el8.0.0+5231+3e842911
Oracle Linux · 8 velocity 0:1.7-24.module+el8.0.0+5231+3e842911
Oracle Linux · 8 xalan-j2 0:2.7.1-38.module+el8.0.0+5231+3e842911
Oracle Linux · 8 xerces-j2 0:2.11.0-34.module+el8.0.0+5231+3e842911
Oracle Linux · 8 xml-commons-apis 0:1.4.01-25.module+el8.0.0+5231+3e842911
Oracle Linux · 8 xml-commons-resolver 0:1.2-26.module+el8.0.0+5231+3e842911
Oracle Linux · 8 xmlstreambuffer 0:1.5.4-8.module+el8.0.0+5231+3e842911
Oracle Linux · 8 xsom 0:0-19.20110809svn.module+el8.0.0+5231+3e842911

Vulnerabilities 4

  • Critical 9.8
    CVE-2018-8014 EPSS 21%

    The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

    The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2018-8034 EPSS 21%

    The host name verification missing in Apache Tomcat

    The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Medium 5.9
    CVE-2018-8037 EPSS 11%

    Apache Tomcat Race Condition vulnerability

    If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NI…

    Apache Software Foundation Apache Tomcat tomcat8 org.apache.tomcat.embed:tomcat-embed-core Ubuntu Maven
  • Medium 4.3
    CVE-2018-11784 Public exploit Scanner template EPSS 98%

    Apache Tomcat Open Redirect vulnerability

    When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redi…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven