Linux · Red Hat · Security advisory · April 28, 2020

RHSA-2020:1644: Security update for 46 packages

RHSA-2020:1644, released April 28, 2020, fixes 12 CVEs across 46 products. None of them is reported as exploited. Patch Radar priority: High.

High
CVEs closed
12
None rated Critical
Exploited
0
None reported
Highest CVSS
9.8
Base score, 0 to 10
Highest EPSS
0.2659
98th percentile

Priority of the 12 CVEs

Patch now 0 Urgent 0 High 12 Routine 0

Fixed package versions

ProductReleaseFixed in
apache-commons-collectionsRHEL 80:3.2.2-10.module+el8.1.0+3366+6dfb954c
apache-commons-langRHEL 80:2.6-21.module+el8.1.0+3366+6dfb954c
bea-stax-apiRHEL 80:1.2.0-16.module+el8.1.0+3366+6dfb954c
glassfish-fastinfosetRHEL 80:1.2.13-9.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-apiRHEL 80:2.2.12-8.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-coreRHEL 80:2.2.11-11.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-runtimeRHEL 80:2.2.11-11.module+el8.1.0+3366+6dfb954c
glassfish-jaxb-txw2RHEL 80:2.2.11-11.module+el8.1.0+3366+6dfb954c
jackson-annotationsRHEL 80:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-coreRHEL 80:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-databindRHEL 80:2.10.0-1.module+el8.2.0+5059+3eb3af25
jackson-jaxrs-json-providerRHEL 80:2.9.9-1.module+el8.1.0+3832+9784644d
jackson-jaxrs-providersRHEL 80:2.9.9-1.module+el8.1.0+3832+9784644d
jackson-module-jaxb-annotationsRHEL 80:2.7.6-4.module+el8.1.0+3366+6dfb954c
jakarta-commons-httpclientRHEL 81:3.1-28.module+el8.1.0+3366+6dfb954c
javassistRHEL 80:3.18.1-8.module+el8.1.0+3366+6dfb954c
javassist-javadocRHEL 80:3.18.1-8.module+el8.1.0+3366+6dfb954c
jssRHEL 80:4.6.2-4.module+el8.2.0+6123+b4678599
jss-javadocRHEL 80:4.6.2-4.module+el8.2.0+6123+b4678599
ldapjdkRHEL 80:4.21.0-2.module+el8.2.0+4573+c3c38c7b
ldapjdk-javadocRHEL 80:4.21.0-2.module+el8.2.0+4573+c3c38c7b
pki-baseRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-base-javaRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-caRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-kraRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-serverRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-servlet-4.0-apiRHEL 81:9.0.7-16.module+el8.1.0+3366+6dfb954c
pki-servlet-engineRHEL 81:9.0.7-16.module+el8.1.0+3366+6dfb954c
pki-symkeyRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
pki-toolsRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
python-nss-docRHEL 80:1.0.1-10.module+el8.1.0+3366+6dfb954c
python3-nssRHEL 80:1.0.1-10.module+el8.1.0+3366+6dfb954c
python3-pkiRHEL 80:10.8.3-1.module+el8.2.0+5925+bad5981a
relaxngDatatypeRHEL 80:2011.1-7.module+el8.1.0+3366+6dfb954c
resteasyRHEL 80:3.0.26-3.module+el8.1.0+3366+6dfb954c
slf4jRHEL 80:1.7.25-4.module+el8.1.0+3366+6dfb954c
slf4j-jdk14RHEL 80:1.7.25-4.module+el8.1.0+3366+6dfb954c
stax-exRHEL 80:1.7.7-8.module+el8.1.0+3366+6dfb954c
tomcatjssRHEL 80:7.4.1-2.module+el8.2.0+4573+c3c38c7b
velocityRHEL 80:1.7-24.module+el8.1.0+3366+6dfb954c
xalan-j2RHEL 80:2.7.1-38.module+el8.1.0+3366+6dfb954c
xerces-j2RHEL 80:2.11.0-34.module+el8.1.0+3366+6dfb954c
xml-commons-apisRHEL 80:1.4.01-25.module+el8.1.0+3366+6dfb954c
xml-commons-resolverRHEL 80:1.2-26.module+el8.1.0+3366+6dfb954c
xmlstreambufferRHEL 80:1.5.4-8.module+el8.1.0+3366+6dfb954c
xsomRHEL 80:0-19.20110809svn.module+el8.1.0+3366+6dfb954c

CVEs this fix closes

PriorityCVETitleCVSSEPSSExploitation
High CVE-2020-8840 xsom: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...8.1 0.2659 None reported
High CVE-2020-9548 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...8.1 0.1892 None reported
High CVE-2020-9547 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...8.1 0.1838 None reported
High CVE-2019-14540 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...9.8 0.1076 None reported
High CVE-2019-20330 bea-stax-api: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...8.1 0.0864 None reported
High CVE-2020-10673 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...8.1 0.0796 None reported
High CVE-2019-16942 pki-tools: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...9.8 0.0568 None reported
High CVE-2019-17531 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...9.8 0.0533 None reported
High CVE-2019-16335 python-nss-doc: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...9.8 0.0492 None reported
High CVE-2019-16943 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...9.8 0.0474 None reported
High CVE-2020-9546 pki-ca: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...8.1 0.0458 None reported
High CVE-2020-10672 apache-commons-collections: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Secur...8.1 0.0306 None reported
Showing 1 to 12 of 12 1

Patch Radar data is free to use with attribution. Terms and how to credit it.

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.