# CVE-2018-8014: apache-commons-collections: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co...

CVE-2018-8014 is fixed in 42 products on 1 platform, first by libservlet3.1-java 8.5.30-1ubuntu1.2, released May 15, 2018. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2018-8014
- Priority: High
- CVSS: 9.8 (Important)
- EPSS: 0.2094
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: May 15, 2018

## Description

The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-core module by Red Hat Certificate System.  Security Fix(es):  * tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up (CVE-2018-8037)  * tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)  * tomcat: Open redirect in default servlet (CVE-2018-11784)  * tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)  For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | apache-commons-collections RHEL 8 | 0:3.2.2-10.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | apache-commons-collections ol 8 | 0:3.2.2-10.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | apache-commons-lang RHEL 8 | 0:2.6-21.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | apache-commons-lang ol 8 | 0:2.6-21.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | bea-stax-api RHEL 8 | 0:1.2.0-16.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | bea-stax-api ol 8 | 0:1.2.0-16.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | glassfish-fastinfoset RHEL 8 | 0:1.2.13-9.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | glassfish-fastinfoset ol 8 | 0:1.2.13-9.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | glassfish-jaxb-api RHEL 8 | 0:2.2.12-8.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | glassfish-jaxb-api ol 8 | 0:2.2.12-8.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | glassfish-jaxb-core RHEL 8 | 0:2.2.11-11.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | glassfish-jaxb-core ol 8 | 0:2.2.11-11.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | glassfish-jaxb-runtime RHEL 8 | 0:2.2.11-11.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | glassfish-jaxb-runtime ol 8 | 0:2.2.11-11.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | glassfish-jaxb-txw2 RHEL 8 | 0:2.2.11-11.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | glassfish-jaxb-txw2 ol 8 | 0:2.2.11-11.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | jackson-annotations RHEL 8 | 0:2.9.8-1.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | jackson-annotations ol 8 | 0:2.9.8-1.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | jackson-core RHEL 8 | 0:2.9.8-1.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | jackson-core ol 8 | 0:2.9.8-1.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | jackson-databind RHEL 8 | 0:2.9.8-1.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | jackson-databind ol 8 | 0:2.9.8-1.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | jackson-jaxrs-json-provider RHEL 8 | 0:2.9.8-1.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | jackson-jaxrs-json-provider ol 8 | 0:2.9.8-1.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | jackson-jaxrs-providers RHEL 8 | 0:2.9.8-1.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | jackson-jaxrs-providers ol 8 | 0:2.9.8-1.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | jackson-module-jaxb-annotations RHEL 8 | 0:2.7.6-4.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | jackson-module-jaxb-annotations ol 8 | 0:2.7.6-4.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | jakarta-commons-httpclient RHEL 8 | 1:3.1-28.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | jakarta-commons-httpclient ol 8 | 1:3.1-28.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | javassist RHEL 8 | 0:3.18.1-8.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | javassist ol 8 | 0:3.18.1-8.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | javassist-javadoc RHEL 8 | 0:3.18.1-8.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | javassist-javadoc ol 8 | 0:3.18.1-8.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | libservlet3.1-java Ubuntu 18.04.6 LTS (bionic) | 8.5.30-1ubuntu1.2 | [libservlet3.1-java 8.5.30-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libservlet3.1-java-8.5.30-1ubuntu1.2.md) | May 15, 2018 |
| Linux | libtomcat8-embed-java Ubuntu 18.04.6 LTS (bionic) | 8.5.30-1ubuntu1.2 | [libtomcat8-embed-java 8.5.30-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libtomcat8-embed-java-8.5.30-1ubuntu1.2.md) | May 15, 2018 |
| Linux | libtomcat8-java Ubuntu 18.04.6 LTS (bionic) | 8.5.30-1ubuntu1.2 | [libtomcat8-java 8.5.30-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-libtomcat8-java-8.5.30-1ubuntu1.2.md) | May 15, 2018 |
| Linux | pki-servlet-4.0-api RHEL 8 | 1:9.0.7-14.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | pki-servlet-4.0-api ol 8 | 1:9.0.7-14.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | pki-servlet-container RHEL 8 | 1:9.0.7-14.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | pki-servlet-container ol 8 | 1:9.0.7-14.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | python-nss-doc RHEL 8 | 0:1.0.1-10.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | python-nss-doc ol 8 | 0:1.0.1-10.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | python3-nss RHEL 8 | 0:1.0.1-10.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | python3-nss ol 8 | 0:1.0.1-10.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | relaxngDatatype RHEL 8 | 0:2011.1-7.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | relaxngDatatype ol 8 | 0:2011.1-7.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | resteasy RHEL 8 | 0:3.0.26-3.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | resteasy ol 8 | 0:3.0.26-3.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | slf4j RHEL 8 | 0:1.7.25-4.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | slf4j ol 8 | 0:1.7.25-4.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | slf4j-jdk14 RHEL 8 | 0:1.7.25-4.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | slf4j-jdk14 ol 8 | 0:1.7.25-4.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | stax-ex RHEL 8 | 0:1.7.7-8.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | stax-ex ol 8 | 0:1.7.7-8.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | tomcat8 Ubuntu 18.04.6 LTS (bionic) | 8.5.30-1ubuntu1.2 | [tomcat8 8.5.30-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-tomcat8-8.5.30-1ubuntu1.2.md) | May 15, 2018 |
| Linux | tomcat8-admin Ubuntu 18.04.6 LTS (bionic) | 8.5.30-1ubuntu1.2 | [tomcat8-admin 8.5.30-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-tomcat8-admin-8.5.30-1ubuntu1.2.md) | May 15, 2018 |
| Linux | tomcat8-common Ubuntu 18.04.6 LTS (bionic) | 8.5.30-1ubuntu1.2 | [tomcat8-common 8.5.30-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-tomcat8-common-8.5.30-1ubuntu1.2.md) | May 15, 2018 |
| Linux | tomcat8-docs Ubuntu 18.04.6 LTS (bionic) | 8.5.30-1ubuntu1.2 | [tomcat8-docs 8.5.30-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-tomcat8-docs-8.5.30-1ubuntu1.2.md) | May 15, 2018 |
| Linux | tomcat8-examples Ubuntu 18.04.6 LTS (bionic) | 8.5.30-1ubuntu1.2 | [tomcat8-examples 8.5.30-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-tomcat8-examples-8.5.30-1ubuntu1.2.md) | May 15, 2018 |
| Linux | tomcat8-user Ubuntu 18.04.6 LTS (bionic) | 8.5.30-1ubuntu1.2 | [tomcat8-user 8.5.30-1ubuntu1.2](https://patchblox.com/security/data/fix/linux/ubuntu-bionic-tomcat8-user-8.5.30-1ubuntu1.2.md) | May 15, 2018 |
| Linux | velocity RHEL 8 | 0:1.7-24.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | velocity ol 8 | 0:1.7-24.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | xalan-j2 RHEL 8 | 0:2.7.1-38.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | xalan-j2 ol 8 | 0:2.7.1-38.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | xerces-j2 RHEL 8 | 0:2.11.0-34.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | xerces-j2 ol 8 | 0:2.11.0-34.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | xml-commons-apis RHEL 8 | 0:1.4.01-25.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | xml-commons-apis ol 8 | 0:1.4.01-25.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | xml-commons-resolver RHEL 8 | 0:1.2-26.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | xml-commons-resolver ol 8 | 0:1.2-26.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | xmlstreambuffer RHEL 8 | 0:1.5.4-8.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | xmlstreambuffer ol 8 | 0:1.5.4-8.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |
| Linux | xsom RHEL 8 | 0:0-19.20110809svn.module+el8.0.0+3248+9d514f3b | [RHSA-2019:1529](https://patchblox.com/security/data/fix/linux/rhsa-2019-1529.md) | Jun 18, 2019 |
| Linux | xsom ol 8 | 0:0-19.20110809svn.module+el8.0.0+5231+3e842911 | [ELSA-2019-1529](https://patchblox.com/security/data/fix/linux/elsa-2019-1529.md) | Jul 30, 2019 |

---

Data as of 2026-11-08T19:12:23Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.