Skip to content
OpenAdvisories
Critical RHSA-2019:1529 4 CVEs

Red Hat Security Advisory: pki-deps:10.6 security update

Published Oct 21, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 38

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream apache-commons-collections 0:3.2.2-10.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream apache-commons-lang 0:2.6-21.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream bea-stax 0:1.2.0-16.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream bea-stax-api 0:1.2.0-16.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream glassfish-fastinfoset 0:1.2.13-9.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream glassfish-jaxb 0:2.2.11-11.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream glassfish-jaxb-api 0:2.2.12-8.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream glassfish-jaxb-core 0:2.2.11-11.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream glassfish-jaxb-runtime 0:2.2.11-11.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream glassfish-jaxb-txw2 0:2.2.11-11.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream jackson-annotations 0:2.9.8-1.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream jackson-core 0:2.9.8-1.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream jackson-databind 0:2.9.8-1.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream jackson-jaxrs-json-provider 0:2.9.8-1.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream jackson-jaxrs-providers 0:2.9.8-1.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream jackson-module-jaxb-annotations 0:2.7.6-4.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream jakarta-commons-httpclient 1:3.1-28.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream javassist 0:3.18.1-8.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream javassist-javadoc 0:3.18.1-8.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream pki-servlet-4.0-api 1:9.0.7-14.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream pki-servlet-container 1:9.0.7-14.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream python-nss 0:1.0.1-10.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream python-nss-debugsource 0:1.0.1-10.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream python-nss-doc 0:1.0.1-10.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-nss 0:1.0.1-10.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream python3-nss-debuginfo 0:1.0.1-10.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream relaxngDatatype 0:2011.1-7.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream resteasy 0:3.0.26-3.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream slf4j 0:1.7.25-4.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream slf4j-jdk14 0:1.7.25-4.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream stax-ex 0:1.7.7-8.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream velocity 0:1.7-24.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream xalan-j2 0:2.7.1-38.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream xerces-j2 0:2.11.0-34.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream xml-commons-apis 0:1.4.01-25.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream xml-commons-resolver 0:1.2-26.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream xmlstreambuffer 0:1.5.4-8.module+el8.0.0+3248+9d514f3b
Red Hat · RHEL 8 enterprise_linux:8::appstream xsom 0:0-19.20110809svn.module+el8.0.0+3248+9d514f3b

Vulnerabilities 4

  • Critical 9.8
    CVE-2018-8014 EPSS 21%

    The defaults settings for the CORS filter provided in Apache Tomcat are insecure and enable 'supportsCredentials' for all origins

    The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable 'supportsCredentials' for all origins. It is expected that users of the CORS filter will have…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.5
    CVE-2018-8034 EPSS 21%

    The host name verification missing in Apache Tomcat

    The host name verification when using TLS with the WebSocket client was missing. It is now enabled by default. Versions Affected: Apache Tomcat 9.0.0.M1 to 9.0.9, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, and 7.0.35 to 7.0.88.

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • Medium 5.9
    CVE-2018-8037 EPSS 11%

    Apache Tomcat Race Condition vulnerability

    If an async request was completed by the application at the same time as the container triggered the async timeout, a race condition existed that could result in a user seeing a response intended for a different user. An additional issue was present in the NI…

    Apache Software Foundation Apache Tomcat tomcat8 org.apache.tomcat.embed:tomcat-embed-core Ubuntu Maven
  • Medium 4.3
    CVE-2018-11784 Public exploit Scanner template EPSS 98%

    Apache Tomcat Open Redirect vulnerability

    When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g. redirecting to '/foo/' when the user requested '/foo') a specially crafted URL could be used to cause the redi…

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1579611
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1607580
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1607582
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1636512
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1529.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-8014
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-8014
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-8014
  • article
    http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.89
  • article
    http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.53
  • article
    http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.32
  • article
    http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.9
  • report
    https://access.redhat.com/security/cve/CVE-2018-8034
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-8034
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-8034
  • report
    https://access.redhat.com/security/cve/CVE-2018-8037
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-8037
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-8037
  • report
    https://access.redhat.com/security/cve/CVE-2018-11784
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-11784
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-11784
  • article
    http://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.91
  • article
    http://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.34
  • article
    http://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.12