Linux · Red Hat · Security advisory · June 18, 2019

RHSA-2019:1529: Security update for 33 packages

RHSA-2019:1529, released June 18, 2019, fixes 4 CVEs across 33 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
4
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.9768
99th percentile

Priority of the 4 CVEs

Patch now 0 Urgent 0 High 3 Routine 1

Fixed package versions

ProductReleaseFixed in
apache-commons-collectionsRHEL 80:3.2.2-10.module+el8.0.0+3248+9d514f3b
apache-commons-langRHEL 80:2.6-21.module+el8.0.0+3248+9d514f3b
bea-stax-apiRHEL 80:1.2.0-16.module+el8.0.0+3248+9d514f3b
glassfish-fastinfosetRHEL 80:1.2.13-9.module+el8.0.0+3248+9d514f3b
glassfish-jaxb-apiRHEL 80:2.2.12-8.module+el8.0.0+3248+9d514f3b
glassfish-jaxb-coreRHEL 80:2.2.11-11.module+el8.0.0+3248+9d514f3b
glassfish-jaxb-runtimeRHEL 80:2.2.11-11.module+el8.0.0+3248+9d514f3b
glassfish-jaxb-txw2RHEL 80:2.2.11-11.module+el8.0.0+3248+9d514f3b
jackson-annotationsRHEL 80:2.9.8-1.module+el8.0.0+3248+9d514f3b
jackson-coreRHEL 80:2.9.8-1.module+el8.0.0+3248+9d514f3b
jackson-databindRHEL 80:2.9.8-1.module+el8.0.0+3248+9d514f3b
jackson-jaxrs-json-providerRHEL 80:2.9.8-1.module+el8.0.0+3248+9d514f3b
jackson-jaxrs-providersRHEL 80:2.9.8-1.module+el8.0.0+3248+9d514f3b
jackson-module-jaxb-annotationsRHEL 80:2.7.6-4.module+el8.0.0+3248+9d514f3b
jakarta-commons-httpclientRHEL 81:3.1-28.module+el8.0.0+3248+9d514f3b
javassistRHEL 80:3.18.1-8.module+el8.0.0+3248+9d514f3b
javassist-javadocRHEL 80:3.18.1-8.module+el8.0.0+3248+9d514f3b
pki-servlet-4.0-apiRHEL 81:9.0.7-14.module+el8.0.0+3248+9d514f3b
pki-servlet-containerRHEL 81:9.0.7-14.module+el8.0.0+3248+9d514f3b
python-nss-docRHEL 80:1.0.1-10.module+el8.0.0+3248+9d514f3b
python3-nssRHEL 80:1.0.1-10.module+el8.0.0+3248+9d514f3b
relaxngDatatypeRHEL 80:2011.1-7.module+el8.0.0+3248+9d514f3b
resteasyRHEL 80:3.0.26-3.module+el8.0.0+3248+9d514f3b
slf4jRHEL 80:1.7.25-4.module+el8.0.0+3248+9d514f3b
slf4j-jdk14RHEL 80:1.7.25-4.module+el8.0.0+3248+9d514f3b
stax-exRHEL 80:1.7.7-8.module+el8.0.0+3248+9d514f3b
velocityRHEL 80:1.7-24.module+el8.0.0+3248+9d514f3b
xalan-j2RHEL 80:2.7.1-38.module+el8.0.0+3248+9d514f3b
xerces-j2RHEL 80:2.11.0-34.module+el8.0.0+3248+9d514f3b
xml-commons-apisRHEL 80:1.4.01-25.module+el8.0.0+3248+9d514f3b
xml-commons-resolverRHEL 80:1.2-26.module+el8.0.0+3248+9d514f3b
xmlstreambufferRHEL 80:1.5.4-8.module+el8.0.0+3248+9d514f3b
xsomRHEL 80:0-19.20110809svn.module+el8.0.0+3248+9d514f3b

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2018-8034 pki-servlet-4.0-api: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co...7.5 0.2105 None reported
High CVE-2018-8014 apache-commons-collections: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co...9.8 0.2094 None reported
High CVE-2018-8037 apache-commons-collections: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co...9.1 0.1116 None reported
Routine CVE-2018-11784 apache-commons-collections: The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-co...5.3 0.9768 None reported
Showing 1 to 4 of 4 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.