RHSA-2020:1644 — Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

Fixed packages 58

Release	Package	Fixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream	apache-commons-collections	0:3.2.2-10.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	apache-commons-lang	0:2.6-21.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	bea-stax	0:1.2.0-16.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	bea-stax-api	0:1.2.0-16.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	glassfish-fastinfoset	0:1.2.13-9.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	glassfish-jaxb	0:2.2.11-11.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	glassfish-jaxb-api	0:2.2.12-8.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	glassfish-jaxb-core	0:2.2.11-11.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	glassfish-jaxb-runtime	0:2.2.11-11.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	glassfish-jaxb-txw2	0:2.2.11-11.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	jackson-annotations	0:2.10.0-1.module+el8.2.0+5059+3eb3af25
Red Hat · RHEL 8 enterprise_linux:8::appstream	jackson-core	0:2.10.0-1.module+el8.2.0+5059+3eb3af25
Red Hat · RHEL 8 enterprise_linux:8::appstream	jackson-databind	0:2.10.0-1.module+el8.2.0+5059+3eb3af25
Red Hat · RHEL 8 enterprise_linux:8::appstream	jackson-jaxrs-json-provider	0:2.9.9-1.module+el8.1.0+3832+9784644d
Red Hat · RHEL 8 enterprise_linux:8::appstream	jackson-jaxrs-providers	0:2.9.9-1.module+el8.1.0+3832+9784644d
Red Hat · RHEL 8 enterprise_linux:8::appstream	jackson-module-jaxb-annotations	0:2.7.6-4.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	jakarta-commons-httpclient	1:3.1-28.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	javassist	0:3.18.1-8.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	javassist-javadoc	0:3.18.1-8.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	jss	0:4.6.2-4.module+el8.2.0+6123+b4678599
Red Hat · RHEL 8 enterprise_linux:8::appstream	jss-debuginfo	0:4.6.2-4.module+el8.2.0+6123+b4678599
Red Hat · RHEL 8 enterprise_linux:8::appstream	jss-debugsource	0:4.6.2-4.module+el8.2.0+6123+b4678599
Red Hat · RHEL 8 enterprise_linux:8::appstream	jss-javadoc	0:4.6.2-4.module+el8.2.0+6123+b4678599
Red Hat · RHEL 8 enterprise_linux:8::appstream	ldapjdk	0:4.21.0-2.module+el8.2.0+4573+c3c38c7b
Red Hat · RHEL 8 enterprise_linux:8::appstream	ldapjdk-javadoc	0:4.21.0-2.module+el8.2.0+4573+c3c38c7b
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-base	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-base-java	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-ca	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-core	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-core-debuginfo	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-core-debugsource	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-kra	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-server	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-servlet-4.0-api	1:9.0.7-16.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-servlet-engine	1:9.0.7-16.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-symkey	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-symkey-debuginfo	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-tools	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	pki-tools-debuginfo	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-nss	0:1.0.1-10.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-nss-debugsource	0:1.0.1-10.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	python-nss-doc	0:1.0.1-10.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-nss	0:1.0.1-10.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-nss-debuginfo	0:1.0.1-10.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	python3-pki	0:10.8.3-1.module+el8.2.0+5925+bad5981a
Red Hat · RHEL 8 enterprise_linux:8::appstream	relaxngDatatype	0:2011.1-7.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	resteasy	0:3.0.26-3.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	slf4j	0:1.7.25-4.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	slf4j-jdk14	0:1.7.25-4.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	stax-ex	0:1.7.7-8.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	tomcatjss	0:7.4.1-2.module+el8.2.0+4573+c3c38c7b
Red Hat · RHEL 8 enterprise_linux:8::appstream	velocity	0:1.7-24.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	xalan-j2	0:2.7.1-38.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	xerces-j2	0:2.11.0-34.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	xml-commons-apis	0:1.4.01-25.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	xml-commons-resolver	0:1.2-26.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	xmlstreambuffer	0:1.5.4-8.module+el8.1.0+3366+6dfb954c
Red Hat · RHEL 8 enterprise_linux:8::appstream	xsom	0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c

Vulnerabilities 12

Critical 9.8

CVE-2019-14540 Public exploit EPSS 11%

Polymorphic Typing issue in FasterXML jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Sep 15, 2019
Critical 9.8

CVE-2019-16335

Polymorphic Typing issue in FasterXML jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Sep 15, 2019
Critical 9.8

CVE-2019-16942

Polymorphic Typing in FasterXML jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in…

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Oct 1, 2019
Critical 9.8

CVE-2019-16943

jackson-databind polymorphic typing issue

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the …

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Oct 1, 2019
Critical 9.8

CVE-2019-17531

jackson-databind polymorphic typing issue

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (versi…

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Oct 12, 2019
Critical 9.8

CVE-2019-20330

Deserialization of Untrusted Data in jackson-databind

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Jan 3, 2020
Critical 9.8

CVE-2020-8840 Public exploit EPSS 27%

Deserialization of Untrusted Data in jackson-databind

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Feb 10, 2020
Critical 9.8

CVE-2020-9546

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Mar 2, 2020
Critical 9.8

CVE-2020-9547 Public exploit Scanner template EPSS 18%

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Mar 2, 2020
Critical 9.8

CVE-2020-9548 Public exploit Scanner template EPSS 19%

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Mar 2, 2020
High 8.8

CVE-2020-10672

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven

Mar 18, 2020
High 8.8

CVE-2020-10673 Public exploit

jackson-databind mishandles the interaction between serialization gadgets and typing

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven

Mar 18, 2020

References

article
https://access.redhat.com/security/updates/classification/#moderate
article
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.2_release_notes/index
report
https://bugzilla.redhat.com/show_bug.cgi?id=1535313
report
https://bugzilla.redhat.com/show_bug.cgi?id=1655438
report
https://bugzilla.redhat.com/show_bug.cgi?id=1656786
report
https://bugzilla.redhat.com/show_bug.cgi?id=1698084
report
https://bugzilla.redhat.com/show_bug.cgi?id=1744095
report
https://bugzilla.redhat.com/show_bug.cgi?id=1755831
report
https://bugzilla.redhat.com/show_bug.cgi?id=1755849
report
https://bugzilla.redhat.com/show_bug.cgi?id=1758187
report
https://bugzilla.redhat.com/show_bug.cgi?id=1758191
report
https://bugzilla.redhat.com/show_bug.cgi?id=1767125
report
https://bugzilla.redhat.com/show_bug.cgi?id=1767131
report
https://bugzilla.redhat.com/show_bug.cgi?id=1775293
report
https://bugzilla.redhat.com/show_bug.cgi?id=1777032
report
https://bugzilla.redhat.com/show_bug.cgi?id=1782486
report
https://bugzilla.redhat.com/show_bug.cgi?id=1795215
report
https://bugzilla.redhat.com/show_bug.cgi?id=1802006
report
https://bugzilla.redhat.com/show_bug.cgi?id=1806840
report
https://bugzilla.redhat.com/show_bug.cgi?id=1807371
report
https://bugzilla.redhat.com/show_bug.cgi?id=1807421
report
https://bugzilla.redhat.com/show_bug.cgi?id=1809210
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1644.json
report
https://access.redhat.com/security/cve/CVE-2019-14540
advisory
https://www.cve.org/CVERecord?id=CVE-2019-14540
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-14540
report
https://access.redhat.com/security/cve/CVE-2019-16335
advisory
https://www.cve.org/CVERecord?id=CVE-2019-16335
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16335
report
https://access.redhat.com/security/cve/CVE-2019-16942
advisory
https://www.cve.org/CVERecord?id=CVE-2019-16942
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16942
report
https://access.redhat.com/security/cve/CVE-2019-16943
advisory
https://www.cve.org/CVERecord?id=CVE-2019-16943
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-16943
report
https://access.redhat.com/security/cve/CVE-2019-17531
advisory
https://www.cve.org/CVERecord?id=CVE-2019-17531
advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-17531
report
https://access.redhat.com/security/cve/CVE-2019-20330

Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

Fixed packages 58

Vulnerabilities 12

Polymorphic Typing issue in FasterXML jackson-databind

Polymorphic Typing issue in FasterXML jackson-databind

Polymorphic Typing in FasterXML jackson-databind

jackson-databind polymorphic typing issue

jackson-databind polymorphic typing issue

Deserialization of Untrusted Data in jackson-databind

Deserialization of Untrusted Data in jackson-databind

jackson-databind mishandles the interaction between serialization gadgets and typing

jackson-databind mishandles the interaction between serialization gadgets and typing

jackson-databind mishandles the interaction between serialization gadgets and typing

jackson-databind mishandles the interaction between serialization gadgets and typing

jackson-databind mishandles the interaction between serialization gadgets and typing

References