RHSA-2019:2720: Important: pki-deps:10.6 security update

Published Sep 10, 2019
·
Updated

The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-core module by Red Hat Certificate System.Security Fix(es): jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution (CVE-2019-12384) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

71 affected componentsFixes available
redhat/apache-commons-collections<3.2.2-10.module+el8.0.0+3892+c903d3f0
3.2.2-10.module+el8.0.0+3892+c903d3f0
redhat/apache-commons-lang<2.6-21.module+el8.0.0+3892+c903d3f0
2.6-21.module+el8.0.0+3892+c903d3f0
redhat/bea-stax<1.2.0-16.module+el8.0.0+3892+c903d3f0
1.2.0-16.module+el8.0.0+3892+c903d3f0
redhat/glassfish-fastinfoset<1.2.13-9.module+el8.0.0+3892+c903d3f0
1.2.13-9.module+el8.0.0+3892+c903d3f0
redhat/glassfish-jaxb<2.2.11-11.module+el8.0.0+3892+c903d3f0
2.2.11-11.module+el8.0.0+3892+c903d3f0
redhat/glassfish-jaxb-api<2.2.12-8.module+el8.0.0+3892+c903d3f0
2.2.12-8.module+el8.0.0+3892+c903d3f0
redhat/jackson-annotations<2.9.9-1.module+el8.0.0+3892+c903d3f0
2.9.9-1.module+el8.0.0+3892+c903d3f0
redhat/jackson-core<2.9.9-1.module+el8.0.0+3892+c903d3f0
2.9.9-1.module+el8.0.0+3892+c903d3f0
redhat/jackson-databind<2.9.9.2-1.module+el8.0.0+3892+c903d3f0
2.9.9.2-1.module+el8.0.0+3892+c903d3f0
redhat/jackson-jaxrs-providers<2.9.9-1.module+el8.0.0+3892+c903d3f0
2.9.9-1.module+el8.0.0+3892+c903d3f0
redhat/jackson-module-jaxb-annotations<2.7.6-4.module+el8.0.0+3892+c903d3f0
2.7.6-4.module+el8.0.0+3892+c903d3f0
redhat/jakarta-commons-httpclient<3.1-28.module+el8.0.0+3892+c903d3f0
3.1-28.module+el8.0.0+3892+c903d3f0
redhat/javassist<3.18.1-8.module+el8.0.0+3892+c903d3f0
3.18.1-8.module+el8.0.0+3892+c903d3f0
redhat/pki-servlet-container<9.0.7-14.module+el8.0.0+3892+c903d3f0
9.0.7-14.module+el8.0.0+3892+c903d3f0
redhat/python-nss<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/resteasy<3.0.26-3.module+el8.0.0+3892+c903d3f0
3.0.26-3.module+el8.0.0+3892+c903d3f0
redhat/slf4j<1.7.25-4.module+el8.0.0+3892+c903d3f0
1.7.25-4.module+el8.0.0+3892+c903d3f0
redhat/stax-ex<1.7.7-8.module+el8.0.0+3892+c903d3f0
1.7.7-8.module+el8.0.0+3892+c903d3f0
redhat/velocity<1.7-24.module+el8.0.0+3892+c903d3f0
1.7-24.module+el8.0.0+3892+c903d3f0
redhat/xalan-j2<2.7.1-38.module+el8.0.0+3892+c903d3f0
2.7.1-38.module+el8.0.0+3892+c903d3f0
redhat/xerces-j2<2.11.0-34.module+el8.0.0+3892+c903d3f0
2.11.0-34.module+el8.0.0+3892+c903d3f0
redhat/xml-commons-apis<1.4.01-25.module+el8.0.0+3892+c903d3f0
1.4.01-25.module+el8.0.0+3892+c903d3f0
redhat/xml-commons-resolver<1.2-26.module+el8.0.0+3892+c903d3f0
1.2-26.module+el8.0.0+3892+c903d3f0
redhat/xmlstreambuffer<1.5.4-8.module+el8.0.0+3892+c903d3f0
1.5.4-8.module+el8.0.0+3892+c903d3f0
redhat/xsom<0-19.20110809svn.module+el8.0.0+3892+c903d3f0
0-19.20110809svn.module+el8.0.0+3892+c903d3f0
redhat/apache-commons-collections<3.2.2-10.module+el8.0.0+3892+c903d3f0
3.2.2-10.module+el8.0.0+3892+c903d3f0
redhat/apache-commons-lang<2.6-21.module+el8.0.0+3892+c903d3f0
2.6-21.module+el8.0.0+3892+c903d3f0
redhat/bea-stax-api<1.2.0-16.module+el8.0.0+3892+c903d3f0
1.2.0-16.module+el8.0.0+3892+c903d3f0
redhat/glassfish-fastinfoset<1.2.13-9.module+el8.0.0+3892+c903d3f0
1.2.13-9.module+el8.0.0+3892+c903d3f0
redhat/glassfish-jaxb-api<2.2.12-8.module+el8.0.0+3892+c903d3f0
2.2.12-8.module+el8.0.0+3892+c903d3f0
redhat/glassfish-jaxb-core<2.2.11-11.module+el8.0.0+3892+c903d3f0
2.2.11-11.module+el8.0.0+3892+c903d3f0
redhat/glassfish-jaxb-runtime<2.2.11-11.module+el8.0.0+3892+c903d3f0
2.2.11-11.module+el8.0.0+3892+c903d3f0
redhat/glassfish-jaxb-txw2<2.2.11-11.module+el8.0.0+3892+c903d3f0
2.2.11-11.module+el8.0.0+3892+c903d3f0
redhat/jackson-annotations<2.9.9-1.module+el8.0.0+3892+c903d3f0
2.9.9-1.module+el8.0.0+3892+c903d3f0
redhat/jackson-core<2.9.9-1.module+el8.0.0+3892+c903d3f0
2.9.9-1.module+el8.0.0+3892+c903d3f0
redhat/jackson-databind<2.9.9.2-1.module+el8.0.0+3892+c903d3f0
2.9.9.2-1.module+el8.0.0+3892+c903d3f0
redhat/jackson-jaxrs-json-provider<2.9.9-1.module+el8.0.0+3892+c903d3f0
2.9.9-1.module+el8.0.0+3892+c903d3f0
redhat/jackson-jaxrs-providers<2.9.9-1.module+el8.0.0+3892+c903d3f0
2.9.9-1.module+el8.0.0+3892+c903d3f0
redhat/jackson-module-jaxb-annotations<2.7.6-4.module+el8.0.0+3892+c903d3f0
2.7.6-4.module+el8.0.0+3892+c903d3f0
redhat/jakarta-commons-httpclient<3.1-28.module+el8.0.0+3892+c903d3f0
3.1-28.module+el8.0.0+3892+c903d3f0
redhat/javassist<3.18.1-8.module+el8.0.0+3892+c903d3f0
3.18.1-8.module+el8.0.0+3892+c903d3f0
redhat/javassist-javadoc<3.18.1-8.module+el8.0.0+3892+c903d3f0
3.18.1-8.module+el8.0.0+3892+c903d3f0
redhat/pki-servlet<4.0-api-9.0.7-14.module+el8.0.0+3892+c903d3f0
4.0-api-9.0.7-14.module+el8.0.0+3892+c903d3f0
redhat/pki-servlet-container<9.0.7-14.module+el8.0.0+3892+c903d3f0
9.0.7-14.module+el8.0.0+3892+c903d3f0
redhat/resteasy<3.0.26-3.module+el8.0.0+3892+c903d3f0
3.0.26-3.module+el8.0.0+3892+c903d3f0
redhat/slf4j<1.7.25-4.module+el8.0.0+3892+c903d3f0
1.7.25-4.module+el8.0.0+3892+c903d3f0
redhat/slf4j-jdk14<1.7.25-4.module+el8.0.0+3892+c903d3f0
1.7.25-4.module+el8.0.0+3892+c903d3f0
redhat/stax-ex<1.7.7-8.module+el8.0.0+3892+c903d3f0
1.7.7-8.module+el8.0.0+3892+c903d3f0
redhat/velocity<1.7-24.module+el8.0.0+3892+c903d3f0
1.7-24.module+el8.0.0+3892+c903d3f0
redhat/xalan-j2<2.7.1-38.module+el8.0.0+3892+c903d3f0
2.7.1-38.module+el8.0.0+3892+c903d3f0
redhat/xerces-j2<2.11.0-34.module+el8.0.0+3892+c903d3f0
2.11.0-34.module+el8.0.0+3892+c903d3f0
redhat/xml-commons-apis<1.4.01-25.module+el8.0.0+3892+c903d3f0
1.4.01-25.module+el8.0.0+3892+c903d3f0
redhat/xml-commons-resolver<1.2-26.module+el8.0.0+3892+c903d3f0
1.2-26.module+el8.0.0+3892+c903d3f0
redhat/xmlstreambuffer<1.5.4-8.module+el8.0.0+3892+c903d3f0
1.5.4-8.module+el8.0.0+3892+c903d3f0
redhat/xsom<0-19.20110809svn.module+el8.0.0+3892+c903d3f0
0-19.20110809svn.module+el8.0.0+3892+c903d3f0
redhat/python-nss-debugsource<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python-nss-doc<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python3-nss<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python3-nss-debuginfo<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python-nss-debugsource<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python-nss-doc<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python3-nss<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python3-nss-debuginfo<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python-nss-debugsource<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python-nss-doc<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python3-nss<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python3-nss-debuginfo<1.0.1-10.module+el8.0.0+3892+c903d3f0
1.0.1-10.module+el8.0.0+3892+c903d3f0
redhat/python-nss-debugsource<1.0.1-10.module+el8.0.0+3892+c903d3f0.aa
1.0.1-10.module+el8.0.0+3892+c903d3f0.aa
redhat/python-nss-doc<1.0.1-10.module+el8.0.0+3892+c903d3f0.aa
1.0.1-10.module+el8.0.0+3892+c903d3f0.aa
redhat/python3-nss<1.0.1-10.module+el8.0.0+3892+c903d3f0.aa
1.0.1-10.module+el8.0.0+3892+c903d3f0.aa
redhat/python3-nss-debuginfo<1.0.1-10.module+el8.0.0+3892+c903d3f0.aa
1.0.1-10.module+el8.0.0+3892+c903d3f0.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/apache-commons-collections to a version that resolves this vulnerability.

    Fixed in 3.2.2-10.module+el8.0.0+3892+c903d3f0
  2. Upgrade

    Upgrade redhat/apache-commons-lang to a version that resolves this vulnerability.

    Fixed in 2.6-21.module+el8.0.0+3892+c903d3f0
  3. Upgrade

    Upgrade redhat/bea-stax to a version that resolves this vulnerability.

    Fixed in 1.2.0-16.module+el8.0.0+3892+c903d3f0
  4. Upgrade

    Upgrade redhat/glassfish-fastinfoset to a version that resolves this vulnerability.

    Fixed in 1.2.13-9.module+el8.0.0+3892+c903d3f0
  5. Upgrade

    Upgrade redhat/glassfish-jaxb to a version that resolves this vulnerability.

    Fixed in 2.2.11-11.module+el8.0.0+3892+c903d3f0
  6. Upgrade

    Upgrade redhat/glassfish-jaxb-api to a version that resolves this vulnerability.

    Fixed in 2.2.12-8.module+el8.0.0+3892+c903d3f0
  7. Upgrade

    Upgrade redhat/jackson-annotations to a version that resolves this vulnerability.

    Fixed in 2.9.9-1.module+el8.0.0+3892+c903d3f0
  8. Upgrade

    Upgrade redhat/jackson-core to a version that resolves this vulnerability.

    Fixed in 2.9.9-1.module+el8.0.0+3892+c903d3f0
  9. Upgrade

    Upgrade redhat/jackson-databind to a version that resolves this vulnerability.

    Fixed in 2.9.9.2-1.module+el8.0.0+3892+c903d3f0
  10. Upgrade

    Upgrade redhat/jackson-jaxrs-providers to a version that resolves this vulnerability.

    Fixed in 2.9.9-1.module+el8.0.0+3892+c903d3f0
  11. Upgrade

    Upgrade redhat/jackson-module-jaxb-annotations to a version that resolves this vulnerability.

    Fixed in 2.7.6-4.module+el8.0.0+3892+c903d3f0
  12. Upgrade

    Upgrade redhat/jakarta-commons-httpclient to a version that resolves this vulnerability.

    Fixed in 3.1-28.module+el8.0.0+3892+c903d3f0
  13. Upgrade

    Upgrade redhat/javassist to a version that resolves this vulnerability.

    Fixed in 3.18.1-8.module+el8.0.0+3892+c903d3f0
  14. Upgrade

    Upgrade redhat/pki-servlet-container to a version that resolves this vulnerability.

    Fixed in 9.0.7-14.module+el8.0.0+3892+c903d3f0
  15. Upgrade

    Upgrade redhat/python-nss to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.0.0+3892+c903d3f0
  16. Upgrade

    Upgrade redhat/resteasy to a version that resolves this vulnerability.

    Fixed in 3.0.26-3.module+el8.0.0+3892+c903d3f0
  17. Upgrade

    Upgrade redhat/slf4j to a version that resolves this vulnerability.

    Fixed in 1.7.25-4.module+el8.0.0+3892+c903d3f0
  18. Upgrade

    Upgrade redhat/stax-ex to a version that resolves this vulnerability.

    Fixed in 1.7.7-8.module+el8.0.0+3892+c903d3f0
  19. Upgrade

    Upgrade redhat/velocity to a version that resolves this vulnerability.

    Fixed in 1.7-24.module+el8.0.0+3892+c903d3f0
  20. Upgrade

    Upgrade redhat/xalan-j2 to a version that resolves this vulnerability.

    Fixed in 2.7.1-38.module+el8.0.0+3892+c903d3f0
  21. Upgrade

    Upgrade redhat/xerces-j2 to a version that resolves this vulnerability.

    Fixed in 2.11.0-34.module+el8.0.0+3892+c903d3f0
  22. Upgrade

    Upgrade redhat/xml-commons-apis to a version that resolves this vulnerability.

    Fixed in 1.4.01-25.module+el8.0.0+3892+c903d3f0
  23. Upgrade

    Upgrade redhat/xml-commons-resolver to a version that resolves this vulnerability.

    Fixed in 1.2-26.module+el8.0.0+3892+c903d3f0
  24. Upgrade

    Upgrade redhat/xmlstreambuffer to a version that resolves this vulnerability.

    Fixed in 1.5.4-8.module+el8.0.0+3892+c903d3f0
  25. Upgrade

    Upgrade redhat/xsom to a version that resolves this vulnerability.

    Fixed in 0-19.20110809svn.module+el8.0.0+3892+c903d3f0
  26. Upgrade

    Upgrade redhat/bea-stax-api to a version that resolves this vulnerability.

    Fixed in 1.2.0-16.module+el8.0.0+3892+c903d3f0
  27. Upgrade

    Upgrade redhat/glassfish-jaxb-core to a version that resolves this vulnerability.

    Fixed in 2.2.11-11.module+el8.0.0+3892+c903d3f0
  28. Upgrade

    Upgrade redhat/glassfish-jaxb-runtime to a version that resolves this vulnerability.

    Fixed in 2.2.11-11.module+el8.0.0+3892+c903d3f0
  29. Upgrade

    Upgrade redhat/glassfish-jaxb-txw2 to a version that resolves this vulnerability.

    Fixed in 2.2.11-11.module+el8.0.0+3892+c903d3f0
  30. Upgrade

    Upgrade redhat/jackson-jaxrs-json-provider to a version that resolves this vulnerability.

    Fixed in 2.9.9-1.module+el8.0.0+3892+c903d3f0
  31. Upgrade

    Upgrade redhat/javassist-javadoc to a version that resolves this vulnerability.

    Fixed in 3.18.1-8.module+el8.0.0+3892+c903d3f0
  32. Upgrade

    Upgrade redhat/pki-servlet to a version that resolves this vulnerability.

    Fixed in 4.0-api-9.0.7-14.module+el8.0.0+3892+c903d3f0
  33. Upgrade

    Upgrade redhat/slf4j-jdk14 to a version that resolves this vulnerability.

    Fixed in 1.7.25-4.module+el8.0.0+3892+c903d3f0
  34. Upgrade

    Upgrade redhat/python-nss-debugsource to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.0.0+3892+c903d3f0
  35. Upgrade

    Upgrade redhat/python-nss-doc to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.0.0+3892+c903d3f0
  36. Upgrade

    Upgrade redhat/python3-nss to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.0.0+3892+c903d3f0
  37. Upgrade

    Upgrade redhat/python3-nss-debuginfo to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.0.0+3892+c903d3f0
  38. Upgrade

    Upgrade redhat/python-nss-debugsource to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.0.0+3892+c903d3f0.aa
  39. Upgrade

    Upgrade redhat/python-nss-doc to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.0.0+3892+c903d3f0.aa
  40. Upgrade

    Upgrade redhat/python3-nss to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.0.0+3892+c903d3f0.aa
  41. Upgrade

    Upgrade redhat/python3-nss-debuginfo to a version that resolves this vulnerability.

    Fixed in 1.0.1-10.module+el8.0.0+3892+c903d3f0.aa

Event History

Mar 15, 2024
Advisory Published
via Red Hat·10:43 PM

Frequently Asked Questions

1

What is the severity of RHSA-2019:2720?

The severity of RHSA-2019:2720 is classified as moderate.

2

How do I fix the vulnerability identified in RHSA-2019:2720?

To fix the vulnerability in RHSA-2019:2720, update the affected packages to the specified remedial versions provided by Red Hat.

3

Which packages are affected by RHSA-2019:2720?

The affected packages include apache-commons-collections, jackson-databind, and several others listed in the advisory.

4

What type of vulnerability is reported in RHSA-2019:2720?

RHSA-2019:2720 reports a vulnerability due to the failure to block the logback-core class from polymorphic deserialization.

5

Is there a risk associated with not addressing RHSA-2019:2720?

Yes, not addressing RHSA-2019:2720 may lead to potential security risks, including unauthenticated remote code execution.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203