CVE-2019-2996
First published: Tue Oct 15 2019(Updated: )
Oracle Java SE 8u221 fixes an unspecified vulnerability in the Deployment component (<a href="https://access.redhat.com/security/cve/CVE-2019-2996">CVE-2019-2996</a>). Upstream has CVSS scored this issue as: 4.2/CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N External Reference: <a href="https://www.oracle.com/security-alerts/cpuoct2019.html#AppendixJAVA">https://www.oracle.com/security-alerts/cpuoct2019.html#AppendixJAVA</a>
Credit: secalert_us@oracle.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/java | <1.8.0-ibm-1:1.8.0.6.0-1jpp.1.el6_10 | 1.8.0-ibm-1:1.8.0.6.0-1jpp.1.el6_10 |
| redhat/java | <1.8.0-ibm-1:1.8.0.6.0-1jpp.1.el7 | 1.8.0-ibm-1:1.8.0.6.0-1jpp.1.el7 |
| redhat/java | <1.8.0-ibm-1:1.8.0.6.0-3.el8_1 | 1.8.0-ibm-1:1.8.0.6.0-3.el8_1 |
| Oracle JDK | =1.8.0-update221 | |
| Oracle JRE | =1.8.0-update221 | |
| NetApp E-Series SANtricity OS Controller | >=11.0.0<=11.50.2 | |
| Netapp E-series Santricity Storage Manager | ||
| Netapp E-series Santricity Unified Manager | ||
| Netapp E-series Santricity Web Services Proxy | ||
| NetApp OnCommand Workflow Automation | ||
| Netapp Snapmanager Oracle | ||
| Netapp Snapmanager Sap | ||
| Redhat Satellite | =5.8 | |
| Redhat Enterprise Linux | =8.0 | |
| Redhat Enterprise Linux Desktop | =6.0 | |
| Redhat Enterprise Linux Desktop | =7.0 | |
| Redhat Enterprise Linux Eus | =8.1 | |
| Redhat Enterprise Linux Eus | =8.6 | |
| Redhat Enterprise Linux Server | =6.0 | |
| Redhat Enterprise Linux Server | =7.0 | |
| Redhat Enterprise Linux Workstation | =6.0 | |
| Redhat Enterprise Linux Workstation | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.ibm.com/support/pages/node/1120071 (Advisory)
- http://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://access.redhat.com/errata/RHSA-2019:4113
- https://access.redhat.com/errata/RHSA-2019:4115
- https://access.redhat.com/errata/RHSA-2020:0006
- https://access.redhat.com/errata/RHSA-2020:0046
- https://security.netapp.com/advisory/ntap-20191017-0001/
- https://access.redhat.com/security/cve/CVE-2019-2996
- https://www.oracle.com/security-alerts/cpuoct2019.html#AppendixJAVA
- https://access.redhat.com/security/cve/cve-2019-2996
- https://bugzilla.redhat.com/show_bug.cgi?id=1778942
- https://www.cve.org/CVERecord?id=CVE-2019-2996 https://nvd.nist.gov/vuln/detail/CVE-2019-2996 https://www.oracle.com/security-alerts/cpuoct2019.html#AppendixJAVA
Parent vulnerabilities
(Appears in the following advisories)
Frequently Asked Questions
What is CVE-2019-2996?
CVE-2019-2996 is a vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE that allows an unauthenticated attacker with network access to compromise the Java SE Deployment component.
How severe is CVE-2019-2996?
CVE-2019-2996 has a severity level of medium (4) according to the Common Vulnerability Scoring System (CVSS).
What software versions are affected by CVE-2019-2996?
The affected software versions are Java SE 8u221 and Java SE Embedded 8u221.
How can I fix CVE-2019-2996?
To fix CVE-2019-2996, update your Java SE or Java SE Embedded to version 8u221.
Where can I find more information about CVE-2019-2996?
You can find more information about CVE-2019-2996 on the following references: [https://access.redhat.com/security/cve/CVE-2019-2996](https://access.redhat.com/security/cve/CVE-2019-2996), [https://www.oracle.com/security-alerts/cpuoct2019.html#AppendixJAVA](https://www.oracle.com/security-alerts/cpuoct2019.html#AppendixJAVA), [https://access.redhat.com/errata/RHSA-2019:4113](https://access.redhat.com/errata/RHSA-2019:4113)
- collector/redhat-cve
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-2996
- collector/ibm-support
- source/IBM
- agent/type
- agent/author
- agent/severity
- agent/references
- agent/remedy
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/nvd-index
- agent/software-canonical-lookup-request
- package-manager/redhat
- vendor/oracle
- canonical/oracle jdk
- version/oracle jdk/1.8.0-update221
- canonical/oracle jre
- version/oracle jre/1.8.0-update221
- vendor/netapp
- canonical/netapp e-series santricity os controller
- version/netapp e-series santricity os controller/11.0.0
- version/netapp e-series santricity os controller/11.50.2
- canonical/netapp e-series santricity storage manager
- canonical/netapp e-series santricity unified manager
- canonical/netapp e-series santricity web services proxy
- canonical/netapp oncommand workflow automation
- canonical/netapp snapmanager oracle
- canonical/netapp snapmanager sap
- vendor/redhat
- canonical/redhat satellite
- version/redhat satellite/5.8
- canonical/redhat enterprise linux
- version/redhat enterprise linux/8.0
- canonical/redhat enterprise linux desktop
- version/redhat enterprise linux desktop/6.0
- version/redhat enterprise linux desktop/7.0
- canonical/redhat enterprise linux eus
- version/redhat enterprise linux eus/8.1
- version/redhat enterprise linux eus/8.6
- canonical/redhat enterprise linux server
- version/redhat enterprise linux server/6.0
- version/redhat enterprise linux server/7.0
- canonical/redhat enterprise linux workstation
- version/redhat enterprise linux workstation/6.0
- version/redhat enterprise linux workstation/7.0