Skip to content
OpenAdvisories
High ELSA-2026-43218 1 CVE

Important: pki-deps:10.6 security update (Oracle Linux 8)

Published Jul 23, 2026 · Updated Jul 23, 2026

Summary

apache-commons-collections
[3.2.2-10]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

[3.2.2-9]
- Remove workaround for symlink->directory rpm bug

[3.2.2-8]
- Allow testframework to still be built even with tests disabled, which is
needed by other packages

[3.2.2-7]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[3.2.2-6]
- Temporarly disable running tests

[3.2.2-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[3.2.2-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[3.2.2-3]
- Add workaround for symlink->directory rpm bug

[3.2.2-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[3.2.2-1]
- Update to upstream version 3.2.2
- Merge two javadoc subpackages
- Install with XMVn
- Specfile cleanup

apache-commons-lang
[2.6-21]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.6-20]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[2.6-19]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[2.6-18]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[2.6-17]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[2.6-16]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

[2.6-15]
- Drop old jakarta provides/obsoletes.

[2.6-14]
- Use Requires: java-headless rebuild (#1067528)

[2.6-13]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild

[2.6-12]
- Rebuild

apache-commons-net
[3.6-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[3.6-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[3.6-1]
- Update to upstream version 3.6

[3.5-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[3.5-1]
- Update to upstream version 3.5

[3.4-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[3.4-2]
- Add workaround for suprious test failure (NET-586)

[3.4-1]
- Update to upstream version 3.4

[3.3-7]
- Disable failing test

[3.3-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

bea-stax
[1.2.0-16]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1.2.0-15]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[1.2.0-14]
- Install with XMvn

[1.2.0-13]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[1.2.0-12]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[1.2.0-11]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[1.2.0-10]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

[1.2.0-9]
- Use .mfiles generated during build

[1.2.0-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_20_Mass_Rebuild

[1.2.0-7]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_19_Mass_Rebuild

glassfish-fastinfoset
[1.2.13-9]
- Regenerate BRs

[1.2.13-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1.2.13-7]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[1.2.13-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[1.2.13-5]
- add missing build requires

[1.2.13-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[1.2.13-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[1.2.13-2]
- introduce license macro

[1.2.13-1]
- update to 1.2.13
- Fix URL
- Add license text

[1.2.12-11]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

glassfish-jaxb
[2.2.11-12]
- Update requiremnts to avoid conflicts with jaxb module packages

[2.2.11-11]
- Avoid dependencies on msv and glassfish-dtd-parser

[2.2.11-10]
- Disable TXW2 compiler module

[2.2.11-9]
- Reduce build deps

[2.2.11-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.2.11-7]
- Specify CDDL license version

[2.2.11-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[2.2.11-5]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[2.2.11-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[2.2.11-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

glassfish-jaxb-api
[2.2.12-8]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[2.2.12-7]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[2.2.12-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[2.2.12-5]
- Regenerate BRs

[2.2.12-4]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[2.2.12-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[2.2.12-2]
- Update to 2.2.12-b141001.1542

[2.2.12-1]
- Update to 2.2.12

[2.2.9-6]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_21_Mass_Rebuild

[2.2.9-5]
- Use Requires: java-headless rebuild (#1067528)

jackson-annotations
[2.21-1]
- Rebase to version 2.21
- Resolves: RHEL-188291

jackson-core
[2.21.4-1]
- Rebase to version 2.21.4
- Resolves: RHEL-188291

jackson-databind
[2.21.4-1]
- Rebase to upstream version 2.21.4
- Resolves: RHEL-188291

jackson-jaxrs-providers
[2.21.4-1]
- Rebase to upstream version 2.21.4
- Resolves: RHEL-188291

jackson-modules-base
[2.21.4-1]
- Update to version 2.21.4
- Resolves: RHEL-188291

jakarta-commons-httpclient
[1:3.1-28]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[1:3.1-27]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_27_Mass_Rebuild

[1:3.1-26]
- Use build-jar-repository for locating dependencies

[1:3.1-25]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_26_Mass_Rebuild

[1:3.1-24]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_24_Mass_Rebuild

[1:3.1-23]
- Respect configured SO_TIMEOUT during SSL handshake
- Resolves: CVE-2015-5262

[1:3.1-22]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_23_Mass_Rebuild

[1:3.1-21]
- Remove legacy Obsoletes/Provides

[1:3.1-20]
- Fix MITM security vulnerability
- Resolves: CVE-2014-3577

Fixed packages 30

ReleasePackageFixed in
Oracle Linux · 8 apache-commons-collections 0:3.2.2-10.module+el8.10.0+90642+1ede0e5a
Oracle Linux · 8 apache-commons-lang 0:2.6-21.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 apache-commons-net 0:3.6-3.module+el8.10.0+90642+1ede0e5a
Oracle Linux · 8 bea-stax-api 0:1.2.0-16.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 glassfish-fastinfoset 0:1.2.13-9.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 glassfish-jaxb-api 0:2.2.12-8.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 glassfish-jaxb-core 0:2.2.11-12.module+el8.10.0+90642+1ede0e5a
Oracle Linux · 8 glassfish-jaxb-runtime 0:2.2.11-12.module+el8.10.0+90642+1ede0e5a
Oracle Linux · 8 glassfish-jaxb-txw2 0:2.2.11-12.module+el8.10.0+90642+1ede0e5a
Oracle Linux · 8 jackson-annotations 0:2.21-1.module+el8.10.0+90972+fe199724
Oracle Linux · 8 jackson-core 0:2.21.4-1.module+el8.10.0+90972+fe199724
Oracle Linux · 8 jackson-databind 0:2.21.4-1.module+el8.10.0+90972+fe199724
Oracle Linux · 8 jackson-jaxrs-json-provider 0:2.21.4-1.module+el8.10.0+90972+fe199724
Oracle Linux · 8 jackson-jaxrs-providers 0:2.21.4-1.module+el8.10.0+90972+fe199724
Oracle Linux · 8 jackson-module-jaxb-annotations 0:2.21.4-2.module+el8.10.0+90972+fe199724
Oracle Linux · 8 jakarta-commons-httpclient 1:3.1-28.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 javassist 0:3.18.1-8.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 javassist-javadoc 0:3.18.1-8.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 pki-servlet-engine 1:9.0.62-1.module+el8.10.0+90642+1ede0e5a
Oracle Linux · 8 relaxngDatatype 0:2011.1-7.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 slf4j 0:1.7.25-4.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 slf4j-jdk14 0:1.7.25-4.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 stax-ex 0:1.7.7-8.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 velocity 0:1.7-24.module+el8.10.0+90642+1ede0e5a
Oracle Linux · 8 xalan-j2 0:2.7.1-38.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 xerces-j2 0:2.11.0-34.module+el8.10.0+90642+1ede0e5a
Oracle Linux · 8 xml-commons-apis 0:1.4.01-25.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 xml-commons-resolver 0:1.2-26.module+el8.10.0+90642+1ede0e5a
Oracle Linux · 8 xmlstreambuffer 0:1.5.4-8.module+el8.10.0+90682+879b1f6e
Oracle Linux · 8 xsom 0:0-19.20110809svn.module+el8.10.0+90642+1ede0e5a

Vulnerabilities 1

  • High 8.1

    jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only…