Fixed packages 47
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | foreman | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | foreman-debug | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | foreman-installer | 1:1.24.1.21-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | foreman-installer-katello | 1:1.24.1.21-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | pulp-rpm | 0:2.21.0.6-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | pulp-rpm-admin-extensions | 0:2.21.0.6-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | pulp-rpm-plugins | 0:2.21.0.6-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | python-pulp-integrity | 0:2.21.0.6-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | python-pulp-rpm-common | 0:2.21.0.6-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | satellite | 0:6.7.2-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | satellite-capsule | 0:6.7.2-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | satellite-common | 0:6.7.2-1.el7sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.7::el7 | satellite-debug-tools | 0:6.7.2-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | candlepin | 0:2.9.28-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | candlepin-selinux | 0:2.9.28-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-cli | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-debug | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-ec2 | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-gce | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-installer | 1:1.24.1.21-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-installer-katello | 1:1.24.1.21-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-journald | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-libvirt | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-openstack | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-ovirt | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-postgresql | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-rackspace | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-telemetry | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | foreman-vmware | 0:1.24.1.24-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | pulp-rpm | 0:2.21.0.6-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | pulp-rpm-admin-extensions | 0:2.21.0.6-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | pulp-rpm-plugins | 0:2.21.0.6-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | python-pulp-integrity | 0:2.21.0.6-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | python-pulp-rpm-common | 0:2.21.0.6-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | satellite | 0:6.7.2-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | satellite-capsule | 0:6.7.2-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | satellite-cli | 0:6.7.2-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | satellite-common | 0:6.7.2-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | satellite-debug-tools | 0:6.7.2-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | tfm-rubygem-fog-vsphere | 0:3.2.1.1-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | tfm-rubygem-foreman_remote_execution | 0:2.0.10.1-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | tfm-rubygem-foreman_remote_execution-cockpit | 0:2.0.10.1-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | tfm-rubygem-foreman_rh_cloud | 0:1.0.9-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | tfm-rubygem-foreman-tasks | 0:0.17.5.6-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | tfm-rubygem-hammer_cli_foreman | 0:0.19.6.5-1.el7sat |
| Red Hat · Satellite 6 satellite:6.7::el7 | tfm-rubygem-katello | 0:3.14.0.25-1.el7sat |
Vulnerabilities 12
-
Critical 9.8
Deserialization of Untrusted Data in jackson-databind
FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.
-
Critical 9.8
Deserialization of Untrusted Data in jackson-databind
FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.
-
Critical 9.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).
-
Critical 9.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).
-
Critical 9.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.aoju.bus.proxy.provider.remoting.RmiProvider (aka bus-proxy).
-
High 8.8
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
-
High 8.1
jackson-databind mishandles the interaction between serialization gadgets and typing
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.springframework.aop.config.MethodLocatingFactoryBean (aka spring-aop).
-
High 8.1
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).
-
High 8.1
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms…
-
High 8.1
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).
-
High 8.1CVE-2020-14195 Public exploit
Deserialization of untrusted data in Jackson Databind
FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to org.jsecurity.realm.jndi.JndiRealmFactory (aka org.jsecurity).
References
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1832581
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1839970
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851128
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851130
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851132
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851133
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851134
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851136
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851137
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851138
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851140
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851141
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851148
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851149
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851151
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851152
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851154
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851157
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851158
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851159
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851160
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1851163
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1854824
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1856834
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1857359
-
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhba-2020_3255.json
-
report
https://access.redhat.com/security/cve/CVE-2019-20330
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1793154
-
advisory
https://www.cve.org/CVERecord?id=CVE-2019-20330
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-20330
-
report
https://access.redhat.com/security/cve/CVE-2020-8840
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1816330
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-8840
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-8840
-
report
https://access.redhat.com/security/cve/CVE-2020-9546
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=1816332
-
advisory
https://www.cve.org/CVERecord?id=CVE-2020-9546
-
advisory
https://nvd.nist.gov/vuln/detail/CVE-2020-9546
-
report
https://access.redhat.com/security/cve/CVE-2020-9547