{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for logging-elasticsearch5-container is now available for Red Hat OpenShift Container Platform 4.1.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains an update for both jackson-databind and guava in the logging-elasticsearch5 container image for Red Hat OpenShift Container Platform 4.1.18.\n\nSecurity Fix(es):\n\n* jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper (CVE-2017-7525)\n\n* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095)\n\n* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) (CVE-2017-17485)\n\n* jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis (CVE-2018-11307)\n\n* jackson-databind: improper polymorphic deserialization of types from Jodd-db library (CVE-2018-12022)\n\n* jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver (CVE-2018-12023)\n\n* jackson-databind: arbitrary code execution in slf4j-ext class (CVE-2018-14718)\n\n* jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes (CVE-2018-14719)\n\n* jackson-databind: improper polymorphic deserialization in axis2-transport-jms class (CVE-2018-19360)\n\n* jackson-databind: improper polymorphic deserialization in openjpa class (CVE-2018-19361)\n\n* jackson-databind: improper polymorphic deserialization in jboss-common-core class (CVE-2018-19362)\n\n* jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution (CVE-2019-12384)\n\n* jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)\n\n* jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485) (CVE-2018-5968)\n\n* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489)\n\n* guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service (CVE-2018-10237)\n\n* jackson-databind: exfiltration/XXE in some JDK classes (CVE-2018-14720)\n\n* jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class (CVE-2018-14721)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. (CVE-2019-12086)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. (CVE-2019-12814)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:2858",
        "url": "https://access.redhat.com/errata/RHSA-2019:2858"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1462702",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1462702"
      },
      {
        "category": "external",
        "summary": "1506612",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1506612"
      },
      {
        "category": "external",
        "summary": "1528565",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1528565"
      },
      {
        "category": "external",
        "summary": "1538332",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1538332"
      },
      {
        "category": "external",
        "summary": "1549276",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1549276"
      },
      {
        "category": "external",
        "summary": "1573391",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1573391"
      },
      {
        "category": "external",
        "summary": "1666415",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666415"
      },
      {
        "category": "external",
        "summary": "1666418",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666418"
      },
      {
        "category": "external",
        "summary": "1666423",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666423"
      },
      {
        "category": "external",
        "summary": "1666428",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666428"
      },
      {
        "category": "external",
        "summary": "1666482",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666482"
      },
      {
        "category": "external",
        "summary": "1666484",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666484"
      },
      {
        "category": "external",
        "summary": "1666489",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666489"
      },
      {
        "category": "external",
        "summary": "1671096",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671096"
      },
      {
        "category": "external",
        "summary": "1671097",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671097"
      },
      {
        "category": "external",
        "summary": "1677341",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677341"
      },
      {
        "category": "external",
        "summary": "1713468",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713468"
      },
      {
        "category": "external",
        "summary": "1725795",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1725795"
      },
      {
        "category": "external",
        "summary": "1725807",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1725807"
      },
      {
        "category": "external",
        "summary": "1737517",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1737517"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2858.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform 4.1.18 logging-elasticsearch5 security update",
    "tracking": {
      "current_release_date": "2024-12-15T18:52:51+00:00",
      "generator": {
        "date": "2024-12-15T18:52:51+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2019:2858",
      "initial_release_date": "2019-09-27T00:13:23+00:00",
      "revision_history": [
        {
          "date": "2019-09-27T00:13:23+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-09-27T00:13:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-15T18:52:51+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 4.1",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 4.1",
                  "product_id": "7Server-RH7-RHOSE-4.1",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:4.1::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64",
                "product": {
                  "name": "openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64",
                  "product_id": "openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-logging-elasticsearch5\u0026tag=v4.1.18-201909201915"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64 as a component of Red Hat OpenShift Container Platform 4.1",
          "product_id": "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        },
        "product_reference": "openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-4.1"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Liao Xinxi"
          ],
          "organization": "NSFOCUS"
        }
      ],
      "cve": "CVE-2017-7525",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2017-06-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1462702"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time:\n\nCandlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected.\n\nHowever as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked.\n\nJBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: \n\nhttps://access.redhat.com/solutions/3279231\n\nAlthough JBoss Fuse ships the vulnerable version of jackson-databind, it does not call on enableDefaultTyping() for any polymorphic deserialization operations which is the root cause of this vulnerability. We have raised a Jira tracker to ensure that jackson-databind will be upgraded for Fuse 7.0, however due to feasibility issues jackson-databind cannot be upgraded in JBoss Fuse 6.3.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-7525"
        },
        {
          "category": "external",
          "summary": "RHBZ#1462702",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1462702"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-7525",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-7525"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7525",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7525"
        }
      ],
      "release_date": "2017-07-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        },
        {
          "category": "workaround",
          "details": "Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Liao Xinxi"
          ],
          "organization": "NSFOCUS"
        }
      ],
      "cve": "CVE-2017-15095",
      "cwe": {
        "id": "CWE-184",
        "name": "Incomplete List of Disallowed Inputs"
      },
      "discovery_date": "2017-10-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1506612"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time:\n\nCandlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected.\n\nHowever as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked.\n\nJBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: \n\nhttps://access.redhat.com/solutions/3279231",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-15095"
        },
        {
          "category": "external",
          "summary": "RHBZ#1506612",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1506612"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-15095",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-15095"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-15095",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15095"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/solutions/3442891",
          "url": "https://access.redhat.com/solutions/3442891"
        }
      ],
      "release_date": "2017-11-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        },
        {
          "category": "workaround",
          "details": "Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "0c0c0f from 360\u89c2\u661f\u5b9e\u9a8c\u5ba4"
          ]
        }
      ],
      "cve": "CVE-2017-17485",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2017-12-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1528565"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of ObjectMapper. This issue extends upon the previous flaws CVE-2017-7525 and CVE-2017-15095 by blacklisting more classes that could be used maliciously.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-17485"
        },
        {
          "category": "external",
          "summary": "RHBZ#1528565",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1528565"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-17485",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-17485"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/solutions/3442891",
          "url": "https://access.redhat.com/solutions/3442891"
        }
      ],
      "release_date": "2017-12-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)"
    },
    {
      "cve": "CVE-2018-5968",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2018-01-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1538332"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A deserialization flaw was discovered in the jackson-databind that could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaws CVE-2017-7525 and CVE-2017-17485 by blacklisting more classes that could be used maliciously.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advice about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: \n\nhttps://access.redhat.com/solutions/3279231\n\nThis issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellitw 6.x. However the affected code is NOT used at this time:\n\nCandlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected.\n\nHowever as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked.\n\nRed Hat Subscription Asset Manager version 1 is now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-5968"
        },
        {
          "category": "external",
          "summary": "RHBZ#1538332",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1538332"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5968",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-5968"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5968",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5968"
        }
      ],
      "release_date": "2018-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)"
    },
    {
      "cve": "CVE-2018-7489",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2018-02-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1549276"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Subscription Asset Manager is now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates.\n\nSatellite 6.2 does not support c3p0 classes. Since the latter are required for this flaw, therefore Satellite 6.2 is not affected.  Satellite 6.3 and 6.4 are not affected because Candlepin does not use polymorphic deserialization.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "RHBZ#1549276",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1549276"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-7489",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/solutions/3442891",
          "url": "https://access.redhat.com/solutions/3442891"
        }
      ],
      "release_date": "2018-02-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        },
        {
          "category": "workaround",
          "details": "Advice on how to remain safe while using JAX-RS webservices on JBoss EAP 7.x is available here:\n\nhttps://access.redhat.com/solutions/3279231\nhttps://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization\n\nGeneral Mitigation: \nTry to avoid  \n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries"
    },
    {
      "cve": "CVE-2018-10237",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2018-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1573391"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Guava where the AtomicDoubleArray and CompoundOrdering classes were found to allocate memory based on size fields sent by the client without validation. A crafted message could cause the server to consume all available memory or crash leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Openshift Application Runtimes: Eclipse Vert.x is not exploitable by this flaw, though the vulnerable code is a transient dependency to the product. This issue may be addressed in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "RHBZ#1573391",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1573391"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-10237",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://github.com/google/guava/wiki/CVE-2018-10237",
          "url": "https://github.com/google/guava/wiki/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion",
          "url": "https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion"
        }
      ],
      "release_date": "2018-04-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service"
    },
    {
      "cve": "CVE-2018-11307",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-02-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1677341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using MyBatis classes when using DefaultTyping. An attacker could use this flaw to achieve content exfiltration and possibly conduct further attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since Candlepin\u0027s java runtime environment does not load MyBatis classes.\n\nRed Hat Virtualization 4 is not affected by this issue, since it does not include MyBatis classes.\n\nRed Hat Fuse 6 and 7 are not directly affected by this issue, as although they do ship the vulnerable jackson-databind component, they do not enable polymorphic deserialization or default typing which are required for exploitability. Their impacts have correspondingly been reduced to Moderate. Future updates may address this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-11307"
        },
        {
          "category": "external",
          "summary": "RHBZ#1677341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-11307",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-11307"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-11307",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11307"
        }
      ],
      "release_date": "2018-05-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis"
    },
    {
      "cve": "CVE-2018-12022",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1671097"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: improper polymorphic deserialization of types from Jodd-db library",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since Candlepin\u0027s java runtime environment does not load Jodd classes.\n\nRed Hat Virtualization 4 is not affected by this issue, since it does not load Jodd classes.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-12022"
        },
        {
          "category": "external",
          "summary": "RHBZ#1671097",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671097"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12022",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-12022"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12022",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12022"
        }
      ],
      "release_date": "2018-05-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: improper polymorphic deserialization of types from Jodd-db library"
    },
    {
      "cve": "CVE-2018-12023",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1671096"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Oracle JDBC classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since Candlepin\u0027s java runtime environment does not load Oracle\u0027s JDBC classes.\n\nRed Hat Virtualization 4 is not affected by this issue, since it does not load Oracle\u0027s JDBC classes.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-12023"
        },
        {
          "category": "external",
          "summary": "RHBZ#1671096",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671096"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12023",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-12023"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12023",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12023"
        }
      ],
      "release_date": "2018-06-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver"
    },
    {
      "cve": "CVE-2018-14718",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666415"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: arbitrary code execution in slf4j-ext class",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in jackson-databind involves exploiting CVE-2018-1088 against slf4j, which was fixed in Red Hat products through the errata referenced at https://access.redhat.com/security/cve/cve-2018-8088. Applications that link only slf4j versions including that fix are not vulnerable to this vulnerability.\n\nRed Hat Satellite 6 is not affected by this issue, since its candlepin component doesn\u0027t bundle slf4j-ext jar.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-14718"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666415",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666415"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14718",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-14718"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14718",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14718"
        }
      ],
      "release_date": "2018-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: arbitrary code execution in slf4j-ext class"
    },
    {
      "cve": "CVE-2018-14719",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666418"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using blaze classes. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The following Red Hat products are not affected by this issue as they do not bundle or provide the requisite gadget jars to exploit this vulnerability:\nRed Hat Satellite 6\nRed Hat Enterprise Virtualization 4\nRed Hat Fuse 6, 7, and Fuse Integration Services 2\nRed Hat A-MQ 6",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-14719"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666418",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666418"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14719",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-14719"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14719",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14719"
        }
      ],
      "release_date": "2018-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes"
    },
    {
      "cve": "CVE-2018-14720",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666423"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: exfiltration/XXE in some JDK classes",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since its only supported Java runtime (openJDK) doesn\u0027t bundle the com.sun.deploy.security.ruleset.DRSHelper class.\n\nRed Hat Enterprise Virtualization 4 is not affected by this issue, since its only supported Java runtime (openJDK) doesn\u0027t bundle the com.sun.deploy.security.ruleset.DRSHelper class.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-14720"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666423",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666423"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14720",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-14720"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14720",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14720"
        }
      ],
      "release_date": "2018-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible \n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: exfiltration/XXE in some JDK classes"
    },
    {
      "cve": "CVE-2018-14721",
      "cwe": {
        "id": "CWE-352",
        "name": "Cross-Site Request Forgery (CSRF)"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666428"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn\u0027t bundle axis2-jaxws jar.\n\nRed Hat Virtualization is not affected by this issue, since its does not bundle axis2-jaxws jar.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-14721"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666428",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666428"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14721",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-14721"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14721",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14721"
        }
      ],
      "release_date": "2018-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class"
    },
    {
      "cve": "CVE-2018-19360",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666482"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the axis2-transport-jms class. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: improper polymorphic deserialization in axis2-transport-jms class",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn\u0027t include axis2-transport-jms jar.\n\nRed Hat Virtualization 4 is not affected by this issue, since it does not include axis2-transport-jms jar.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-19360"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666482",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666482"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-19360",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-19360"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-19360",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19360"
        }
      ],
      "release_date": "2018-11-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: improper polymorphic deserialization in axis2-transport-jms class"
    },
    {
      "cve": "CVE-2018-19361",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666484"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the OpenJPA class. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: improper polymorphic deserialization in openjpa class",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn\u0027t bundle openjpa jar.\n\nRed Hat Virtualization 4 is not affected by this issue, since its candlepin component doesn\u0027t bundle openjpa jar.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-19361"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666484",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666484"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-19361",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-19361"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-19361",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19361"
        }
      ],
      "release_date": "2018-11-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: improper polymorphic deserialization in openjpa class"
    },
    {
      "cve": "CVE-2018-19362",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666489"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the jboss-common-core class. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: improper polymorphic deserialization in jboss-common-core class",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn\u0027t bundle jboss-common-core jar.\n\nRed Hat Virtualization 4 is not affected by this issue, since its candlepin component doesn\u0027t bundle jboss-common-core jar.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-19362"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666489",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666489"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-19362",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-19362"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-19362",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19362"
        }
      ],
      "release_date": "2018-11-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: improper polymorphic deserialization in jboss-common-core class"
    },
    {
      "cve": "CVE-2019-12086",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-05-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1713468"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-12086"
        },
        {
          "category": "external",
          "summary": "RHBZ#1713468",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713468"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-12086",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-12086"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12086"
        }
      ],
      "release_date": "2019-05-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible\n\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server."
    },
    {
      "cve": "CVE-2019-12384",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-06-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1725807"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. Depending on the classpath content, remote code execution may be possible.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack\u0027s OpenDaylight does not use logback in any supported configuration. Therefore, the prerequisites for this vulnerability are not present and OpenDaylight is not affected.\n\nThis vulnerability relies on logback-core (ch.qos.logback.core) being present in the application\u0027s ClassPath. Logback-core is not packaged as an RPM for Red Hat Enterprise Linux or Red Hat Software Collections. Applications using jackson-databind that do not also use logback-core are not impacted by this vulnerability.\n\nThis issue affects the versions of jackson-databind bundled with candlepin as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-12384"
        },
        {
          "category": "external",
          "summary": "RHBZ#1725807",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1725807"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-12384",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-12384"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12384",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12384"
        }
      ],
      "release_date": "2019-06-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible:\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution"
    },
    {
      "cve": "CVE-2019-12814",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-06-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1725795"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "* Red Hat Satellite 6 does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability. \n* Red Hat OpenStack\u0027s OpenDaylight does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-12814"
        },
        {
          "category": "external",
          "summary": "RHBZ#1725795",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1725795"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-12814",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-12814"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12814"
        }
      ],
      "release_date": "2019-06-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        },
        {
          "category": "workaround",
          "details": "This vulnerability relies on jdom (org.jdom) or jdom2 (org.jdom2) being present in the application\u0027s ClassPath.  Applications using jackson-databind that do not also use jdom or jdom2 are not impacted by this vulnerability.",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message."
    },
    {
      "cve": "CVE-2019-14379",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-07-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1737517"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: default typing mishandling leading to remote code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nSimilarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-14379"
        },
        {
          "category": "external",
          "summary": "RHBZ#1737517",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1737517"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-14379",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-14379"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-14379",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14379"
        }
      ],
      "release_date": "2019-07-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-09-27T00:13:23+00:00",
          "details": "For OpenShift Container Platform 4.1 see the following documentation, which\nwill be updated shortly for release 4.1.18, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:2858"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-4.1:openshift4/ose-logging-elasticsearch5@sha256:797e81b7dd36ecd46ffa45466ab8013b1e6a5e2f477e89295e54b154b7aff59b_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: default typing mishandling leading to remote code execution"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for logging-elasticsearch5-container is now available for Red Hat OpenShift Container Platform 3.11.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nThis advisory contains an update for jackson-databind in the logging-elasticsearch5 container image for Red Hat OpenShift Container Platform 3.11.153.\n\nSecurity Fix(es):\n\n* jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper (CVE-2017-7525)\n\n* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095)\n\n* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) (CVE-2017-17485)\n\n* jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis (CVE-2018-11307)\n\n* jackson-databind: improper polymorphic deserialization of types from Jodd-db library (CVE-2018-12022)\n\n* jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver (CVE-2018-12023)\n\n* jackson-databind: arbitrary code execution in slf4j-ext class (CVE-2018-14718)\n\n* jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes (CVE-2018-14719)\n\n* jackson-databind: improper polymorphic deserialization in axis2-transport-jms class (CVE-2018-19360)\n\n* jackson-databind: improper polymorphic deserialization in openjpa class (CVE-2018-19361)\n\n* jackson-databind: improper polymorphic deserialization in jboss-common-core class (CVE-2018-19362)\n\n* jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution (CVE-2019-12384)\n\n* jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)\n\n* jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485) (CVE-2018-5968)\n\n* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489)\n\n* guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service (CVE-2018-10237)\n\n* jackson-databind: exfiltration/XXE in some JDK classes (CVE-2018-14720)\n\n* jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class (CVE-2018-14721)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. (CVE-2019-12086)\n\n* jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. (CVE-2019-12814)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:3149",
        "url": "https://access.redhat.com/errata/RHSA-2019:3149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1462702",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1462702"
      },
      {
        "category": "external",
        "summary": "1506612",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1506612"
      },
      {
        "category": "external",
        "summary": "1528565",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1528565"
      },
      {
        "category": "external",
        "summary": "1538332",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1538332"
      },
      {
        "category": "external",
        "summary": "1549276",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1549276"
      },
      {
        "category": "external",
        "summary": "1573391",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1573391"
      },
      {
        "category": "external",
        "summary": "1666415",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666415"
      },
      {
        "category": "external",
        "summary": "1666418",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666418"
      },
      {
        "category": "external",
        "summary": "1666423",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666423"
      },
      {
        "category": "external",
        "summary": "1666428",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666428"
      },
      {
        "category": "external",
        "summary": "1666482",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666482"
      },
      {
        "category": "external",
        "summary": "1666484",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666484"
      },
      {
        "category": "external",
        "summary": "1666489",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666489"
      },
      {
        "category": "external",
        "summary": "1671096",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671096"
      },
      {
        "category": "external",
        "summary": "1671097",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671097"
      },
      {
        "category": "external",
        "summary": "1677341",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677341"
      },
      {
        "category": "external",
        "summary": "1713468",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713468"
      },
      {
        "category": "external",
        "summary": "1725795",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1725795"
      },
      {
        "category": "external",
        "summary": "1725807",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1725807"
      },
      {
        "category": "external",
        "summary": "1737517",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1737517"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3149.json"
      }
    ],
    "title": "Red Hat Security Advisory: OpenShift Container Platform logging-elasticsearch5-container security update",
    "tracking": {
      "current_release_date": "2024-12-15T18:53:16+00:00",
      "generator": {
        "date": "2024-12-15T18:53:16+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.3"
        }
      },
      "id": "RHSA-2019:3149",
      "initial_release_date": "2019-10-18T19:52:06+00:00",
      "revision_history": [
        {
          "date": "2019-10-18T19:52:06+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-10-18T19:52:06+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-12-15T18:53:16+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat OpenShift Container Platform 3.11",
                "product": {
                  "name": "Red Hat OpenShift Container Platform 3.11",
                  "product_id": "7Server-RH7-RHOSE-3.11",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:openshift:3.11::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat OpenShift Enterprise"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64",
                "product": {
                  "name": "openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64",
                  "product_id": "openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d?arch=amd64\u0026repository_url=registry.redhat.io/openshift3/ose-logging-elasticsearch5\u0026tag=v3.11.153-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
                "product": {
                  "name": "openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
                  "product_id": "openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
                  "product_identification_helper": {
                    "purl": "pkg:oci/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d?arch=ppc64le\u0026repository_url=registry.redhat.io/openshift3/ose-logging-elasticsearch5\u0026tag=v3.11.153-2"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "ppc64le"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le as a component of Red Hat OpenShift Container Platform 3.11",
          "product_id": "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le"
        },
        "product_reference": "openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64 as a component of Red Hat OpenShift Container Platform 3.11",
          "product_id": "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        },
        "product_reference": "openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64",
        "relates_to_product_reference": "7Server-RH7-RHOSE-3.11"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Liao Xinxi"
          ],
          "organization": "NSFOCUS"
        }
      ],
      "cve": "CVE-2017-7525",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2017-06-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1462702"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time:\n\nCandlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected.\n\nHowever as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked.\n\nJBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: \n\nhttps://access.redhat.com/solutions/3279231\n\nAlthough JBoss Fuse ships the vulnerable version of jackson-databind, it does not call on enableDefaultTyping() for any polymorphic deserialization operations which is the root cause of this vulnerability. We have raised a Jira tracker to ensure that jackson-databind will be upgraded for Fuse 7.0, however due to feasibility issues jackson-databind cannot be upgraded in JBoss Fuse 6.3.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-7525"
        },
        {
          "category": "external",
          "summary": "RHBZ#1462702",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1462702"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-7525",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-7525"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-7525",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-7525"
        }
      ],
      "release_date": "2017-07-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        },
        {
          "category": "workaround",
          "details": "Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Liao Xinxi"
          ],
          "organization": "NSFOCUS"
        }
      ],
      "cve": "CVE-2017-15095",
      "cwe": {
        "id": "CWE-184",
        "name": "Incomplete List of Disallowed Inputs"
      },
      "discovery_date": "2017-10-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1506612"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaw CVE-2017-7525 by blacklisting more classes that could be used maliciously.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time:\n\nCandlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected.\n\nHowever as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked.\n\nJBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advise about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: \n\nhttps://access.redhat.com/solutions/3279231",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-15095"
        },
        {
          "category": "external",
          "summary": "RHBZ#1506612",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1506612"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-15095",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-15095"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-15095",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-15095"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/solutions/3442891",
          "url": "https://access.redhat.com/solutions/3442891"
        }
      ],
      "release_date": "2017-11-02T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        },
        {
          "category": "workaround",
          "details": "Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525)"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "0c0c0f from 360\u89c2\u661f\u5b9e\u9a8c\u5ba4"
          ]
        }
      ],
      "cve": "CVE-2017-17485",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2017-12-06T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1528565"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A deserialization flaw was discovered in the jackson-databind which could allow an unauthenticated user to perform code execution by sending maliciously crafted input to the readValue method of ObjectMapper. This issue extends upon the previous flaws CVE-2017-7525 and CVE-2017-15095 by blacklisting more classes that could be used maliciously.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-17485"
        },
        {
          "category": "external",
          "summary": "RHBZ#1528565",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1528565"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-17485",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-17485"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-17485"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/solutions/3442891",
          "url": "https://access.redhat.com/solutions/3442891"
        }
      ],
      "release_date": "2017-12-12T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095)"
    },
    {
      "cve": "CVE-2018-5968",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2018-01-22T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1538332"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A deserialization flaw was discovered in the jackson-databind that could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This issue extends the previous flaws CVE-2017-7525 and CVE-2017-17485 by blacklisting more classes that could be used maliciously.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "JBoss EAP 7.x only uses the vulnerable Jackson Databind library for marshalling and unmarshalling of JSON objects passed to JAX-RS webservices. Some advice about how to remain safe when using JAX-RS webservices on JBoss EAP 7.x is available here: \n\nhttps://access.redhat.com/solutions/3279231\n\nThis issue affects the versions of jackson-databind (in Satellite 6.0 and 6.1) and candlepin (which embeds a copy of jackson-databind in Satellite 6.2) as shipped with Red Hat Satellitw 6.x. However the affected code is NOT used at this time:\n\nCandlepin currently uses the default type resolution configuration for the ObjectMappers it creates/uses. Nowhere in candlepin do we enable global polymorphic deserialization via enableDefaultTyping(...), therefore based on the documentation sited BZ 1462702 , candlepin should not be affected.\n\nHowever as the vulnerable software ships with the product we have marked them as vulnerable to ensure the issue is tracked.\n\nRed Hat Subscription Asset Manager version 1 is now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-5968"
        },
        {
          "category": "external",
          "summary": "RHBZ#1538332",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1538332"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-5968",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-5968"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-5968",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-5968"
        }
      ],
      "release_date": "2018-01-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)"
    },
    {
      "cve": "CVE-2018-7489",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2018-02-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1549276"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Subscription Asset Manager is now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates.\n\nSatellite 6.2 does not support c3p0 classes. Since the latter are required for this flaw, therefore Satellite 6.2 is not affected.  Satellite 6.3 and 6.4 are not affected because Candlepin does not use polymorphic deserialization.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "RHBZ#1549276",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1549276"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-7489",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/solutions/3442891",
          "url": "https://access.redhat.com/solutions/3442891"
        }
      ],
      "release_date": "2018-02-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        },
        {
          "category": "workaround",
          "details": "Advice on how to remain safe while using JAX-RS webservices on JBoss EAP 7.x is available here:\n\nhttps://access.redhat.com/solutions/3279231\nhttps://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization\n\nGeneral Mitigation: \nTry to avoid  \n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries"
    },
    {
      "cve": "CVE-2018-10237",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2018-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1573391"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Guava where the AtomicDoubleArray and CompoundOrdering classes were found to allocate memory based on size fields sent by the client without validation. A crafted message could cause the server to consume all available memory or crash leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Openshift Application Runtimes: Eclipse Vert.x is not exploitable by this flaw, though the vulnerable code is a transient dependency to the product. This issue may be addressed in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "RHBZ#1573391",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1573391"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-10237",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://github.com/google/guava/wiki/CVE-2018-10237",
          "url": "https://github.com/google/guava/wiki/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion",
          "url": "https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion"
        }
      ],
      "release_date": "2018-04-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service"
    },
    {
      "cve": "CVE-2018-11307",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-02-14T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1677341"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using MyBatis classes when using DefaultTyping. An attacker could use this flaw to achieve content exfiltration and possibly conduct further attacks.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since Candlepin\u0027s java runtime environment does not load MyBatis classes.\n\nRed Hat Virtualization 4 is not affected by this issue, since it does not include MyBatis classes.\n\nRed Hat Fuse 6 and 7 are not directly affected by this issue, as although they do ship the vulnerable jackson-databind component, they do not enable polymorphic deserialization or default typing which are required for exploitability. Their impacts have correspondingly been reduced to Moderate. Future updates may address this flaw.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-11307"
        },
        {
          "category": "external",
          "summary": "RHBZ#1677341",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1677341"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-11307",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-11307"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-11307",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-11307"
        }
      ],
      "release_date": "2018-05-10T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis"
    },
    {
      "cve": "CVE-2018-12022",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1671097"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: improper polymorphic deserialization of types from Jodd-db library",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since Candlepin\u0027s java runtime environment does not load Jodd classes.\n\nRed Hat Virtualization 4 is not affected by this issue, since it does not load Jodd classes.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-12022"
        },
        {
          "category": "external",
          "summary": "RHBZ#1671097",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671097"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12022",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-12022"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12022",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12022"
        }
      ],
      "release_date": "2018-05-29T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: improper polymorphic deserialization of types from Jodd-db library"
    },
    {
      "cve": "CVE-2018-12023",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-16T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1671096"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Oracle JDBC classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since Candlepin\u0027s java runtime environment does not load Oracle\u0027s JDBC classes.\n\nRed Hat Virtualization 4 is not affected by this issue, since it does not load Oracle\u0027s JDBC classes.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-12023"
        },
        {
          "category": "external",
          "summary": "RHBZ#1671096",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671096"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-12023",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-12023"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-12023",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12023"
        }
      ],
      "release_date": "2018-06-08T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 5.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver"
    },
    {
      "cve": "CVE-2018-14718",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666415"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using slf4j classes. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: arbitrary code execution in slf4j-ext class",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in jackson-databind involves exploiting CVE-2018-1088 against slf4j, which was fixed in Red Hat products through the errata referenced at https://access.redhat.com/security/cve/cve-2018-8088. Applications that link only slf4j versions including that fix are not vulnerable to this vulnerability.\n\nRed Hat Satellite 6 is not affected by this issue, since its candlepin component doesn\u0027t bundle slf4j-ext jar.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-14718"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666415",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666415"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14718",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-14718"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14718",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14718"
        }
      ],
      "release_date": "2018-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: arbitrary code execution in slf4j-ext class"
    },
    {
      "cve": "CVE-2018-14719",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666418"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using blaze classes. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The following Red Hat products are not affected by this issue as they do not bundle or provide the requisite gadget jars to exploit this vulnerability:\nRed Hat Satellite 6\nRed Hat Enterprise Virtualization 4\nRed Hat Fuse 6, 7, and Fuse Integration Services 2\nRed Hat A-MQ 6",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-14719"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666418",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666418"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14719",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-14719"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14719",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14719"
        }
      ],
      "release_date": "2018-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes"
    },
    {
      "cve": "CVE-2018-14720",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666423"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: exfiltration/XXE in some JDK classes",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since its only supported Java runtime (openJDK) doesn\u0027t bundle the com.sun.deploy.security.ruleset.DRSHelper class.\n\nRed Hat Enterprise Virtualization 4 is not affected by this issue, since its only supported Java runtime (openJDK) doesn\u0027t bundle the com.sun.deploy.security.ruleset.DRSHelper class.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-14720"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666423",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666423"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14720",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-14720"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14720",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14720"
        }
      ],
      "release_date": "2018-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible \n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: exfiltration/XXE in some JDK classes"
    },
    {
      "cve": "CVE-2018-14721",
      "cwe": {
        "id": "CWE-352",
        "name": "Cross-Site Request Forgery (CSRF)"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666428"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn\u0027t bundle axis2-jaxws jar.\n\nRed Hat Virtualization is not affected by this issue, since its does not bundle axis2-jaxws jar.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-14721"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666428",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666428"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14721",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-14721"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14721",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14721"
        }
      ],
      "release_date": "2018-07-27T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class"
    },
    {
      "cve": "CVE-2018-19360",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666482"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the axis2-transport-jms class. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: improper polymorphic deserialization in axis2-transport-jms class",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn\u0027t include axis2-transport-jms jar.\n\nRed Hat Virtualization 4 is not affected by this issue, since it does not include axis2-transport-jms jar.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-19360"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666482",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666482"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-19360",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-19360"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-19360",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19360"
        }
      ],
      "release_date": "2018-11-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: improper polymorphic deserialization in axis2-transport-jms class"
    },
    {
      "cve": "CVE-2018-19361",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666484"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the OpenJPA class. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: improper polymorphic deserialization in openjpa class",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn\u0027t bundle openjpa jar.\n\nRed Hat Virtualization 4 is not affected by this issue, since its candlepin component doesn\u0027t bundle openjpa jar.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-19361"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666484",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666484"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-19361",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-19361"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-19361",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19361"
        }
      ],
      "release_date": "2018-11-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: improper polymorphic deserialization in openjpa class"
    },
    {
      "cve": "CVE-2018-19362",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-01-02T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1666489"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in jackson-databind, where it would permit polymorphic deserialization of a malicious object using the jboss-common-core class. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: improper polymorphic deserialization in jboss-common-core class",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 is not affected by this issue, since its candlepin component doesn\u0027t bundle jboss-common-core jar.\n\nRed Hat Virtualization 4 is not affected by this issue, since its candlepin component doesn\u0027t bundle jboss-common-core jar.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-19362"
        },
        {
          "category": "external",
          "summary": "RHBZ#1666489",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666489"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-19362",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-19362"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-19362",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-19362"
        }
      ],
      "release_date": "2018-11-18T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: improper polymorphic deserialization in jboss-common-core class"
    },
    {
      "cve": "CVE-2019-12086",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-05-18T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1713468"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-12086"
        },
        {
          "category": "external",
          "summary": "RHBZ#1713468",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1713468"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-12086",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-12086"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12086",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12086"
        }
      ],
      "release_date": "2019-05-14T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible\n\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server."
    },
    {
      "cve": "CVE-2019-12384",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-06-25T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1725807"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in FasterXML jackson-databind in versions prior to 2.9.9. The vulnerability would permit polymorphic deserialization of malicious objects using the logback-core gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. Depending on the classpath content, remote code execution may be possible.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat OpenStack\u0027s OpenDaylight does not use logback in any supported configuration. Therefore, the prerequisites for this vulnerability are not present and OpenDaylight is not affected.\n\nThis vulnerability relies on logback-core (ch.qos.logback.core) being present in the application\u0027s ClassPath. Logback-core is not packaged as an RPM for Red Hat Enterprise Linux or Red Hat Software Collections. Applications using jackson-databind that do not also use logback-core are not impacted by this vulnerability.\n\nThis issue affects the versions of jackson-databind bundled with candlepin as shipped with Red Hat Satellite 6.x. However the affected code is NOT used at this time.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-12384"
        },
        {
          "category": "external",
          "summary": "RHBZ#1725807",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1725807"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-12384",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-12384"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12384",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12384"
        }
      ],
      "release_date": "2019-06-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible:\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution"
    },
    {
      "cve": "CVE-2019-12814",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-06-20T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1725795"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A new polymorphic typing flaw was discovered in FasterXML jackson-databind, versions 2.x through 2.9.9. With default typing enabled, an attacker can send a specifically crafted JSON message to the server that allows them to read arbitrary local files.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "* Red Hat Satellite 6 does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability. \n* Red Hat OpenStack\u0027s OpenDaylight does not include the jdom or jdom2 packages, thus it is not affected by this vulnerability.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-12814"
        },
        {
          "category": "external",
          "summary": "RHBZ#1725795",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1725795"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-12814",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-12814"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-12814",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-12814"
        }
      ],
      "release_date": "2019-06-04T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        },
        {
          "category": "workaround",
          "details": "This vulnerability relies on jdom (org.jdom) or jdom2 (org.jdom2) being present in the application\u0027s ClassPath.  Applications using jackson-databind that do not also use jdom or jdom2 are not impacted by this vulnerability.",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message."
    },
    {
      "cve": "CVE-2019-14379",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "discovery_date": "2019-07-29T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1737517"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the ehcache and logback JNDI gadgets when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: default typing mishandling leading to remote code execution",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nSimilarly, Satellite 6 does not enable polymorphic unmarshmalling, which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
          "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-14379"
        },
        {
          "category": "external",
          "summary": "RHBZ#1737517",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1737517"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-14379",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-14379"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-14379",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14379"
        }
      ],
      "release_date": "2019-07-23T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-10-18T19:52:06+00:00",
          "details": "See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:3149"
        },
        {
          "category": "workaround",
          "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:2c0cd0ca2711f326d906be032a93883d485088478e36c06f01fdf7328e4fa57d_ppc64le",
            "7Server-RH7-RHOSE-3.11:openshift3/ose-logging-elasticsearch5@sha256:7b93cae88b28f76b9d61feb298447b958aade685ade34767c856b2fdf7229b7d_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: default typing mishandling leading to remote code execution"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "This is a security update for JBoss EAP Continuous Delivery 13.0.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform CD13 is a platform for Java applications based on the WildFly application runtime.\n\nThis release of Red Hat JBoss Enterprise Application Platform CD13 includes bug fixes and enhancements. \n\nSecurity Fix(es):\n\n* guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service (CVE-2018-10237)\n* undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993) (CVE-2018-1067)\n* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489)\n* wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip) (CVE-2018-10862)\n* undertow: client can use bogus uri in digest authentication (CVE-2017-12196)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2020:2562",
        "url": "https://access.redhat.com/errata/RHSA-2020:2562"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1503055",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1503055"
      },
      {
        "category": "external",
        "summary": "1549276",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1549276"
      },
      {
        "category": "external",
        "summary": "1550671",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1550671"
      },
      {
        "category": "external",
        "summary": "1573391",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1573391"
      },
      {
        "category": "external",
        "summary": "1593527",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1593527"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2562.json"
      }
    ],
    "title": "Red Hat Security Advisory: EAP Continuous Delivery Technical Preview Release 13 security update",
    "tracking": {
      "current_release_date": "2026-06-30T11:36:04+00:00",
      "generator": {
        "date": "2026-06-30T11:36:04+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.1"
        }
      },
      "id": "RHSA-2020:2562",
      "initial_release_date": "2020-06-15T16:13:47+00:00",
      "revision_history": [
        {
          "date": "2020-06-15T16:13:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-06-15T16:13:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-06-30T11:36:04+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform Continuous Delivery",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform Continuous Delivery",
                  "product_id": "Red Hat JBoss Enterprise Application Platform Continuous Delivery",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_cd:13"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Jan Stourac"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2017-12196",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2017-10-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1503055"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that when using Digest authentication, the server does not ensure that the value of the URI in the authorization header matches the URI in the HTTP request line. This allows the attacker to execute a MITM attack and access the desired content on the server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: Client can use bogus uri in Digest authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-12196"
        },
        {
          "category": "external",
          "summary": "RHBZ#1503055",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1503055"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-12196",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-12196"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-12196",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12196"
        }
      ],
      "release_date": "2018-03-12T15:56:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-06-15T16:13:47+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nYou must restart the JBoss server process for the update to take effect.\n\nThe References section of this erratum contains a download link (you must log in to download the update)",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2562"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undertow: Client can use bogus uri in Digest authentication"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ammarit Thongthua",
            "Nattakit Intarasorn"
          ],
          "organization": "Deloitte Thailand Pentest team"
        }
      ],
      "cve": "CVE-2018-1067",
      "cwe": {
        "id": "CWE-113",
        "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)"
      },
      "discovery_date": "2018-03-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1550671"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-1067"
        },
        {
          "category": "external",
          "summary": "RHBZ#1550671",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1550671"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1067",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1067"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1067",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1067"
        }
      ],
      "release_date": "2018-04-25T17:51:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-06-15T16:13:47+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nYou must restart the JBoss server process for the update to take effect.\n\nThe References section of this erratum contains a download link (you must log in to download the update)",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2562"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)"
    },
    {
      "cve": "CVE-2018-7489",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2018-02-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1549276"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was discovered in FasterXML jackson-databind, where it would permit polymorphic deserialization of malicious objects using the c3p0 gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Subscription Asset Manager is now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates.\n\nSatellite 6.2 does not support c3p0 classes. Since the latter are required for this flaw, therefore Satellite 6.2 is not affected.  Satellite 6.3 and 6.4 are not affected because Candlepin does not use polymorphic deserialization.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "RHBZ#1549276",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1549276"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-7489",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/solutions/3442891",
          "url": "https://access.redhat.com/solutions/3442891"
        }
      ],
      "release_date": "2018-02-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-06-15T16:13:47+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nYou must restart the JBoss server process for the update to take effect.\n\nThe References section of this erratum contains a download link (you must log in to download the update)",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2562"
        },
        {
          "category": "workaround",
          "details": "Advice on how to remain safe while using JAX-RS webservices on JBoss EAP 7.x is available here:\n\nhttps://access.redhat.com/solutions/3279231\nhttps://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization\n\nGeneral Mitigation: \nTry to avoid  \n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries"
    },
    {
      "cve": "CVE-2018-10237",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2018-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1573391"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Guava where the AtomicDoubleArray and CompoundOrdering classes were found to allocate memory based on size fields sent by the client without validation. A crafted message could cause the server to consume all available memory or crash leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Openshift Application Runtimes: Eclipse Vert.x is not exploitable by this flaw, though the vulnerable code is a transient dependency to the product. This issue may be addressed in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "RHBZ#1573391",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1573391"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-10237",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://github.com/google/guava/wiki/CVE-2018-10237",
          "url": "https://github.com/google/guava/wiki/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion",
          "url": "https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion"
        }
      ],
      "release_date": "2018-04-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-06-15T16:13:47+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nYou must restart the JBoss server process for the update to take effect.\n\nThe References section of this erratum contains a download link (you must log in to download the update)",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2562"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service"
    },
    {
      "cve": "CVE-2018-10862",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2018-06-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1593527"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the explode function of the deployment utility in jboss-cli and console that allows extraction of files from an archive does not perform necessary validation for directory traversal. This can lead to remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability can only be exploited by users with deployment permissions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-10862"
        },
        {
          "category": "external",
          "summary": "RHBZ#1593527",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1593527"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-10862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-10862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10862"
        },
        {
          "category": "external",
          "summary": "https://snyk.io/research/zip-slip-vulnerability",
          "url": "https://snyk.io/research/zip-slip-vulnerability"
        }
      ],
      "release_date": "2018-06-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-06-15T16:13:47+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nYou must restart the JBoss server process for the update to take effect.\n\nThe References section of this erratum contains a download link (you must log in to download the update)",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2562"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "This is a security update for JBoss EAP Continuous Delivery 13.0.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat JBoss Enterprise Application Platform CD13 is a platform for Java applications based on the WildFly application runtime.\n\nThis release of Red Hat JBoss Enterprise Application Platform CD13 includes bug fixes and enhancements. \n\nSecurity Fix(es):\n\n* guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service (CVE-2018-10237)\n* undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993) (CVE-2018-1067)\n* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489)\n* wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip) (CVE-2018-10862)\n* undertow: client can use bogus uri in digest authentication (CVE-2017-12196)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2020:2562",
        "url": "https://access.redhat.com/errata/RHSA-2020:2562"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1503055",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1503055"
      },
      {
        "category": "external",
        "summary": "1549276",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1549276"
      },
      {
        "category": "external",
        "summary": "1550671",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1550671"
      },
      {
        "category": "external",
        "summary": "1573391",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1573391"
      },
      {
        "category": "external",
        "summary": "1593527",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1593527"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2562.json"
      }
    ],
    "title": "Red Hat Security Advisory: EAP Continuous Delivery Technical Preview Release 13 security update",
    "tracking": {
      "current_release_date": "2024-11-15T03:23:30+00:00",
      "generator": {
        "date": "2024-11-15T03:23:30+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2020:2562",
      "initial_release_date": "2020-06-15T16:13:47+00:00",
      "revision_history": [
        {
          "date": "2020-06-15T16:13:47+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2020-06-15T16:13:47+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T03:23:30+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat JBoss Enterprise Application Platform Continuous Delivery",
                "product": {
                  "name": "Red Hat JBoss Enterprise Application Platform Continuous Delivery",
                  "product_id": "Red Hat JBoss Enterprise Application Platform Continuous Delivery",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform_cd:13"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat JBoss Enterprise Application Platform"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Jan Stourac"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2017-12196",
      "cwe": {
        "id": "CWE-287",
        "name": "Improper Authentication"
      },
      "discovery_date": "2017-10-03T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1503055"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was discovered that when using Digest authentication, the server does not ensure that the value of the URI in the authorization header matches the URI in the HTTP request line. This allows the attacker to execute a MITM attack and access the desired content on the server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: Client can use bogus uri in Digest authentication",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2017-12196"
        },
        {
          "category": "external",
          "summary": "RHBZ#1503055",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1503055"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2017-12196",
          "url": "https://www.cve.org/CVERecord?id=CVE-2017-12196"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-12196",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12196"
        }
      ],
      "release_date": "2018-03-12T15:56:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-06-15T16:13:47+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nYou must restart the JBoss server process for the update to take effect.\n\nThe References section of this erratum contains a download link (you must log in to download the update)",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2562"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 4.8,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undertow: Client can use bogus uri in Digest authentication"
    },
    {
      "acknowledgments": [
        {
          "names": [
            "Ammarit Thongthua",
            "Nattakit Intarasorn"
          ],
          "organization": "Deloitte Thailand Pentest team"
        }
      ],
      "cve": "CVE-2018-1067",
      "cwe": {
        "id": "CWE-113",
        "name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)"
      },
      "discovery_date": "2018-03-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1550671"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and validation of user input before the input is used as part of an HTTP header value.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-1067"
        },
        {
          "category": "external",
          "summary": "RHBZ#1550671",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1550671"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-1067",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-1067"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-1067",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-1067"
        }
      ],
      "release_date": "2018-04-25T17:51:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-06-15T16:13:47+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nYou must restart the JBoss server process for the update to take effect.\n\nThe References section of this erratum contains a download link (you must log in to download the update)",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2562"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)"
    },
    {
      "cve": "CVE-2018-7489",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2018-02-26T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1549276"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readValue method of the ObjectMapper, bypassing a blacklist that is ineffective if the c3p0 libraries are available in the classpath.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Subscription Asset Manager is now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having a security impact of Moderate, and is not currently planned to be addressed in future updates.\n\nSatellite 6.2 does not support c3p0 classes. Since the latter are required for this flaw, therefore Satellite 6.2 is not affected.  Satellite 6.3 and 6.4 are not affected because Candlepin does not use polymorphic deserialization.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "RHBZ#1549276",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1549276"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-7489",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-7489"
        },
        {
          "category": "external",
          "summary": "https://access.redhat.com/solutions/3442891",
          "url": "https://access.redhat.com/solutions/3442891"
        }
      ],
      "release_date": "2018-02-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-06-15T16:13:47+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nYou must restart the JBoss server process for the update to take effect.\n\nThe References section of this erratum contains a download link (you must log in to download the update)",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2562"
        },
        {
          "category": "workaround",
          "details": "Advice on how to remain safe while using JAX-RS webservices on JBoss EAP 7.x is available here:\n\nhttps://access.redhat.com/solutions/3279231\nhttps://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization\n\nGeneral Mitigation: \nTry to avoid  \n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries"
    },
    {
      "cve": "CVE-2018-10237",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2018-05-01T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1573391"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability was found in Guava where the AtomicDoubleArray and CompoundOrdering classes were found to allocate memory based on size fields sent by the client without validation. A crafted message could cause the server to consume all available memory or crash leading to a denial of service.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Red Hat Openshift Application Runtimes: Eclipse Vert.x is not exploitable by this flaw, though the vulnerable code is a transient dependency to the product. This issue may be addressed in a future release.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "RHBZ#1573391",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1573391"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-10237",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://github.com/google/guava/wiki/CVE-2018-10237",
          "url": "https://github.com/google/guava/wiki/CVE-2018-10237"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion",
          "url": "https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion"
        }
      ],
      "release_date": "2018-04-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-06-15T16:13:47+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nYou must restart the JBoss server process for the update to take effect.\n\nThe References section of this erratum contains a download link (you must log in to download the update)",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2562"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service"
    },
    {
      "cve": "CVE-2018-10862",
      "cwe": {
        "id": "CWE-22",
        "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
      },
      "discovery_date": "2018-06-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1593527"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "It was found that the explode function of the deployment utility in jboss-cli and console that allows extraction of files from an archive does not perform necessary validation for directory traversal. This can lead to remote code execution.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability can only be exploited by users with deployment permissions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2018-10862"
        },
        {
          "category": "external",
          "summary": "RHBZ#1593527",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1593527"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2018-10862",
          "url": "https://www.cve.org/CVERecord?id=CVE-2018-10862"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10862",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10862"
        },
        {
          "category": "external",
          "summary": "https://snyk.io/research/zip-slip-vulnerability",
          "url": "https://snyk.io/research/zip-slip-vulnerability"
        }
      ],
      "release_date": "2018-06-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2020-06-15T16:13:47+00:00",
          "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nYou must restart the JBoss server process for the update to take effect.\n\nThe References section of this erratum contains a download link (you must log in to download the update)",
          "product_ids": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2020:2562"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 7.6,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L",
            "version": "3.0"
          },
          "products": [
            "Red Hat JBoss Enterprise Application Platform Continuous Delivery"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erh\u00f6hen oder einen Denial of Service zu verursachen",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- UNIX\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0770 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2022-0770.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0770 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0770"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6198380 vom 2020-04-23",
        "url": "https://www.ibm.com/support/pages/node/6198380"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2020:2603 vom 2020-06-17",
        "url": "https://access.redhat.com/errata/RHSA-2020:2603"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2020:4807 vom 2020-11-04",
        "url": "https://access.redhat.com/errata/RHSA-2020:4807"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2021:3225 vom 2021-08-20",
        "url": "https://access.redhat.com/errata/RHSA-2021:3225"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2022-115 vom 2022-05-27",
        "url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-115/index.html"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 6605881 vom 2022-07-21",
        "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-have-been-identified-in-ibm-db2-shipped-with-ibm-puredata-system-for-operational-analytics/"
      },
      {
        "category": "external",
        "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-144 vom 2023-10-03",
        "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-144/index.html"
      },
      {
        "category": "external",
        "summary": "Dell Security Advisory DSA-2024-070 vom 2024-02-03",
        "url": "https://www.dell.com/support/kbdoc/000221770/dsa-2024-="
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7153639 vom 2024-05-17",
        "url": "https://www.ibm.com/support/pages/node/7153639"
      },
      {
        "category": "external",
        "summary": "IBM Security Bulletin 7256605 vom 2026-01-09",
        "url": "https://www.ibm.com/support/pages/node/7256605"
      }
    ],
    "source_lang": "en-US",
    "title": "IBM DB2: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2026-01-08T23:00:00.000+00:00",
      "generator": {
        "date": "2026-01-09T07:40:17.215+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.5.0"
        }
      },
      "id": "WID-SEC-W-2022-0770",
      "initial_release_date": "2020-04-23T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2020-04-23T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2020-06-17T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2020-11-03T23:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2021-08-19T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-05-26T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2022-07-20T22:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2023-10-03T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von HITACHI aufgenommen"
        },
        {
          "date": "2024-02-04T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von Dell aufgenommen"
        },
        {
          "date": "2024-05-16T22:00:00.000+00:00",
          "number": "9",
          "summary": "Neue Updates von IBM aufgenommen"
        },
        {
          "date": "2026-01-08T23:00:00.000+00:00",
          "number": "10",
          "summary": "Neue Updates von IBM aufgenommen"
        }
      ],
      "status": "final",
      "version": "10"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "EMC Avamar",
            "product": {
              "name": "EMC Avamar",
              "product_id": "T014381",
              "product_identification_helper": {
                "cpe": "cpe:/a:emc:avamar:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "EMC"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Hitachi Ops Center",
                "product": {
                  "name": "Hitachi Ops Center",
                  "product_id": "T017562",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hitachi:ops_center:-"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cAnalyzer 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center \u003cAnalyzer 10.9.3-00",
                  "product_id": "T030196"
                }
              },
              {
                "category": "product_version",
                "name": "Analyzer 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center Analyzer 10.9.3-00",
                  "product_id": "T030196-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hitachi:ops_center:analyzer_10.9.3-00"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003cViewpoint 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center \u003cViewpoint 10.9.3-00",
                  "product_id": "T030197"
                }
              },
              {
                "category": "product_version",
                "name": "Viewpoint 10.9.3-00",
                "product": {
                  "name": "Hitachi Ops Center Viewpoint 10.9.3-00",
                  "product_id": "T030197-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:hitachi:ops_center:viewpoint_10.9.3-00"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Ops Center"
          }
        ],
        "category": "vendor",
        "name": "Hitachi"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "11.1",
                "product": {
                  "name": "IBM DB2 11.1",
                  "product_id": "342000",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:db2:11.1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "11.5",
                "product": {
                  "name": "IBM DB2 11.5",
                  "product_id": "695419",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:db2:11.5"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "DB2"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "Analytic Server",
                "product": {
                  "name": "IBM SPSS Analytic Server",
                  "product_id": "T011787",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:ibm:spss:analytic_server"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "SPSS"
          }
        ],
        "category": "vendor",
        "name": "IBM"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2009-0001",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2009-0001"
    },
    {
      "cve": "CVE-2014-0114",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2014-0114"
    },
    {
      "cve": "CVE-2014-0193",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2014-0193"
    },
    {
      "cve": "CVE-2014-3488",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2014-3488"
    },
    {
      "cve": "CVE-2015-2156",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2015-2156"
    },
    {
      "cve": "CVE-2016-2402",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2016-2402"
    },
    {
      "cve": "CVE-2017-12972",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-12972"
    },
    {
      "cve": "CVE-2017-12973",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-12973"
    },
    {
      "cve": "CVE-2017-12974",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-12974"
    },
    {
      "cve": "CVE-2017-18640",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-18640"
    },
    {
      "cve": "CVE-2017-3734",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-3734"
    },
    {
      "cve": "CVE-2017-5637",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2017-5637"
    },
    {
      "cve": "CVE-2018-10237",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2018-10237"
    },
    {
      "cve": "CVE-2018-11771",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2018-11771"
    },
    {
      "cve": "CVE-2018-8009",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2018-8009"
    },
    {
      "cve": "CVE-2018-8012",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2018-8012"
    },
    {
      "cve": "CVE-2019-0201",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-0201"
    },
    {
      "cve": "CVE-2019-10086",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-10086"
    },
    {
      "cve": "CVE-2019-10172",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-10172"
    },
    {
      "cve": "CVE-2019-10202",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-10202"
    },
    {
      "cve": "CVE-2019-12402",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-12402"
    },
    {
      "cve": "CVE-2019-16869",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-16869"
    },
    {
      "cve": "CVE-2019-17195",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-17195"
    },
    {
      "cve": "CVE-2019-17571",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-17571"
    },
    {
      "cve": "CVE-2019-9512",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-9512"
    },
    {
      "cve": "CVE-2019-9514",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-9514"
    },
    {
      "cve": "CVE-2019-9515",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-9515"
    },
    {
      "cve": "CVE-2019-9518",
      "product_status": {
        "known_affected": [
          "T014381",
          "342000",
          "67646",
          "T011787",
          "695419",
          "T030196",
          "T017562",
          "T030197"
        ]
      },
      "release_date": "2020-04-23T22:00:00.000+00:00",
      "title": "CVE-2019-9518"
    }
  ]
}