Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2020-11022 (GCVE-0-2020-11022)
Vulnerability from cvelistv5
Published
2020-04-29 00:00
Modified
2024-08-04 11:21
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-04T11:21:14.453Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "DSA-4693", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://www.debian.org/security/2020/dsa-4693" }, { "name": "FEDORA-2020-11be4b36d4", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/" }, { "name": "FEDORA-2020-36d2db5f51", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujul2020.html" }, { "tags": [ "x_transferred" ], "url": "https://jquery.com/upgrade-guide/3.5/" }, { "tags": [ "x_transferred" ], "url": "https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2" }, { "tags": [ "x_transferred" ], "url": "https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77" }, { "tags": [ "x_transferred" ], "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "tags": [ "x_transferred" ], "url": "https://security.netapp.com/advisory/ntap-20200511-0006/" }, { "tags": [ "x_transferred" ], "url": "https://www.drupal.org/sa-core-2020-002" }, { "name": "openSUSE-SU-2020:1060", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html" }, { "name": "GLSA-202007-03", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202007-03" }, { "name": "openSUSE-SU-2020:1106", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html" }, { "name": "[airflow-commits] 20200820 [GitHub] [airflow] breser opened a new issue #10429: jquery dependency needs to be updated to 3.5.0 or newer", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3E" }, { "name": "FEDORA-2020-fbb94073a1", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/" }, { "name": "FEDORA-2020-0b32a59b54", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/" }, { "name": "FEDORA-2020-fe94df8c34", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" }, { "name": "[flink-issues] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E" }, { "name": "[flink-dev] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E" }, { "name": "openSUSE-SU-2020:1888", "tags": [ "vendor-advisory", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html" }, { "name": "[flink-issues] 20201129 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "tags": [ "x_transferred" ], "url": "https://www.tenable.com/security/tns-2020-11" }, { "tags": [ "x_transferred" ], "url": "https://www.tenable.com/security/tns-2020-10" }, { "name": "[flink-issues] 20210209 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E" }, { "name": "[flink-issues] 20210209 [jira] [Comment Edited] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E" }, { "name": "[debian-lts-announce] 20210326 [SECURITY] [DLA 2608-1] jquery security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html" }, { "name": "[flink-issues] 20210422 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E" }, { "name": "[flink-issues] 20210422 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E" }, { "name": "[flink-issues] 20210429 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E" }, { "name": "[flink-issues] 20210429 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "tags": [ "x_transferred" ], "url": "https://www.tenable.com/security/tns-2021-10" }, { "tags": [ "x_transferred" ], "url": "https://www.tenable.com/security/tns-2021-02" }, { "tags": [ "x_transferred" ], "url": "http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "name": "[flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "tags": [ "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "name": "[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "jQuery", "vendor": "jquery", "versions": [ { "status": "affected", "version": "\u003e= 1.2, \u003c 3.5.0" } ] } ], "descriptions": [ { "lang": "en", "value": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0." } ], "metrics": [ { "cvssV3_1": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N", "version": "3.1" } } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2023-08-31T02:06:33.630688", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M" }, "references": [ { "name": "DSA-4693", "tags": [ "vendor-advisory" ], "url": "https://www.debian.org/security/2020/dsa-4693" }, { "name": "FEDORA-2020-11be4b36d4", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/" }, { "name": "FEDORA-2020-36d2db5f51", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/" }, { "url": "https://www.oracle.com/security-alerts/cpujul2020.html" }, { "url": "https://jquery.com/upgrade-guide/3.5/" }, { "url": "https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2" }, { "url": "https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77" }, { "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "url": "https://security.netapp.com/advisory/ntap-20200511-0006/" }, { "url": "https://www.drupal.org/sa-core-2020-002" }, { "name": "openSUSE-SU-2020:1060", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html" }, { "name": "GLSA-202007-03", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/202007-03" }, { "name": "openSUSE-SU-2020:1106", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html" }, { "name": "[airflow-commits] 20200820 [GitHub] [airflow] breser opened a new issue #10429: jquery dependency needs to be updated to 3.5.0 or newer", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3E" }, { "name": "FEDORA-2020-fbb94073a1", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/" }, { "name": "FEDORA-2020-0b32a59b54", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/" }, { "name": "FEDORA-2020-fe94df8c34", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/" }, { "url": "https://www.oracle.com/security-alerts/cpuoct2020.html" }, { "name": "[flink-issues] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E" }, { "name": "[flink-dev] 20201105 [jira] [Created] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E" }, { "name": "openSUSE-SU-2020:1888", "tags": [ "vendor-advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html" }, { "name": "[flink-issues] 20201129 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E" }, { "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "url": "https://www.tenable.com/security/tns-2020-11" }, { "url": "https://www.tenable.com/security/tns-2020-10" }, { "name": "[flink-issues] 20210209 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E" }, { "name": "[flink-issues] 20210209 [jira] [Comment Edited] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E" }, { "name": "[debian-lts-announce] 20210326 [SECURITY] [DLA 2608-1] jquery security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html" }, { "name": "[flink-issues] 20210422 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E" }, { "name": "[flink-issues] 20210422 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E" }, { "name": "[flink-issues] 20210429 [jira] [Commented] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E" }, { "name": "[flink-issues] 20210429 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E" }, { "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "url": "https://www.tenable.com/security/tns-2021-10" }, { "url": "https://www.tenable.com/security/tns-2021-02" }, { "url": "http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html" }, { "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "name": "[flink-issues] 20211031 [jira] [Updated] (FLINK-20014) Resolve CVE-2020-11022 and CVE-2020-11023 in scala-compiler", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E" }, { "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "url": "https://www.oracle.com/security-alerts/cpujul2022.html" }, { "name": "[debian-lts-announce] 20230831 [SECURITY] [DLA 3551-1] otrs2 security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html" } ], "source": { "advisory": "GHSA-gxr4-xjj5-5px2", "discovery": "UNKNOWN" }, "title": "Potential XSS vulnerability in jQuery" } }, "cveMetadata": { "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2020-11022", "datePublished": "2020-04-29T00:00:00", "dateReserved": "2020-03-30T00:00:00", "dateUpdated": "2024-08-04T11:21:14.453Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "vulnerability-lookup:meta": { "fkie_nvd": { "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"1.2\", \"versionEndExcluding\": \"3.5.0\", \"matchCriteriaId\": \"B5CFA4CA-5296-4B78-8D65-34FC63A09DEF\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"7.0\", \"versionEndExcluding\": \"7.70\", \"matchCriteriaId\": \"70C672EE-2027-4A29-8C14-3450DEF1462A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.7.0\", \"versionEndExcluding\": \"8.7.14\", \"matchCriteriaId\": \"BBFE42E2-6583-4EBE-B320-B8CF9CA0C3BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.8.0\", \"versionEndExcluding\": \"8.8.6\", \"matchCriteriaId\": \"7BA49DB0-ECC3-4155-B76C-0CA292600DE6\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"36D96259-24BD-44E2-96D9-78CE1D41F956\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A079FD6E-3BB0-4997-9A8E-6F8FEC89887A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A125E817-F974-4509-872C-B71933F42AD1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BBE7BF09-B89C-4590-821E-6C0587E096B5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"ADAE8A71-0BCD-42D5-B38C-9B2A27CC1E6B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E7231D2D-4092-44F3-B60A-D7C9ED78AFDF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F7BDFC10-45A0-46D8-AB92-4A5E2C1C76ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"18127694-109C-4E7E-AE79-0BA351849291\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"33F68878-BC19-4DB8-8A72-BD9FE3D0ACEC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"21.1.2\", \"matchCriteriaId\": \"D0DBC938-A782-433F-8BF1-CA250C332AA7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B796AC70-A220-48D8-B8CD-97CF57227962\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"790A89FD-6B86-49AE-9B4F-AE7262915E13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E39D442D-1997-49AF-8B02-5640BE2A26CC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\\\\::*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndIncluding\": \"8.2.2\", \"matchCriteriaId\": \"FAFED7F5-03FA-43B5-AD13-1130F0324448\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"16.1.0\", \"versionEndIncluding\": \"16.4.0\", \"matchCriteriaId\": \"1A0E3537-CB5A-40BF-B42C-CED9211B8892\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"062E4E7C-55BB-46F3-8B61-5A663B565891\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"726DB59B-00C7-444E-83F7-CB31032482AB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B095CC03-7077-4A58-AB25-CC5380CDCE5A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7015A8CB-8FA6-423E-8307-BD903244F517\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6.0.0\", \"versionEndIncluding\": \"8.1.0.0.0\", \"matchCriteriaId\": \"F2BB6A71-6AF6-4C0B-9304-4111E32108D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.8\", \"matchCriteriaId\": \"AD080793-FC45-4260-8E45-40E228F432FC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2ACA29E6-F393-46E5-B2B3-9158077819A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FCD1EC13-CC2F-4668-90D2-D8609066F2DF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4D614F76-0AA1-4EA8-A24A-38EFC90EF5DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"39B8DFFF-B037-4F29-8C8E-F4BBC3435199\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4D0D0EAC-300D-44B1-AD4A-93A368D5DBA1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.8\", \"matchCriteriaId\": \"C5E0646D-4866-41FB-AE2E-5307B6F4004A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8A566893-8DCF-49E4-93D0-0ACCEFD70D3D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.8\", \"matchCriteriaId\": \"B37FC113-4F40-4D29-8712-7AD250373008\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"00E5D719-249D-48B8-BAFC-1E14D250B3F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.1.0\", \"matchCriteriaId\": \"712577A9-04D6-4579-A82B-72200E467399\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.9\", \"matchCriteriaId\": \"672949B4-1989-4AA7-806F-EEC07D07F317\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"987A0C35-4C7F-4FFB-B47B-37B69A32F879\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3B6BE3-4C5A-402F-832C-86A0A6234C25\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9476D1DA-C8A8-40A0-94DD-9B46C05FD461\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"34070F24-2E53-43EC-9117-E1434B2C4C2B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B9B2C2F6-235F-4E78-A299-18C041C05C9A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F727AAC6-6D9F-4B28-B07C-6A93916C43A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.8\", \"matchCriteriaId\": \"6662C783-5B5C-4559-89F5-1A681AA46A3E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51C17460-D326-4525-A7D1-0AED53E75E18\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"37C8EE84-A840-4132-B331-C7D450B1FBBF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1D8436A2-9CA3-4C91-B632-9B03368ABC1B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A00142E6-EEB3-44BD-AB0D-0E5C5640557F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6149C89E-0111-4CF9-90CA-0662D2F75E04\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6CDDF6CA-6441-4606-9D2F-22A67BA46978\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6FA0B592-A216-4320-A4FE-ABCA6B3E7D7A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CEA4D6CF-D54A-40DF-9B70-E13392D0BE19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.8\", \"matchCriteriaId\": \"2A333755-4B6E-4A0F-AC48-4CEA70CD5801\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"397B1A24-7C95-4A73-8363-4529A7F6CFCC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF6D5112-4055-4F89-A5B3-0DCB109481B7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D262848E-AA24-4057-A747-6221BA22ADF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4A01F8ED-64DA-43BC-9C02-488010BCD0F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"75638A6A-88B2-4BC7-84EA-1CF5FC30D555\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"501B9331-6BB7-44BF-A664-180CAFABF88C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F2A3AE3C-8E24-4FB6-9954-9B50CBD59B21\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F8E565DA-91BE-44FC-A28F-579BE8D2281A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.1.0\", \"matchCriteriaId\": \"AED72F90-3B68-45AC-865C-110F7FD30D37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.9\", \"matchCriteriaId\": \"4F909C61-1A74-402C-B74F-BAF7297875B0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"26A1F27B-C3AC-4D13-B9B2-2D6CF65D07BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B95E8056-51D8-4390-ADE3-661B7AE1D7CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"609D6EDF-D4D0-4370-9B8B-CA39D41946C0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9059A907-508B-4844-8D7B-0FA68C0DF6A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2AC63D10-2326-4542-B345-31D45B9A7408\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"19.1.0\", \"versionEndIncluding\": \"19.1.2\", \"matchCriteriaId\": \"7BFD7783-BE15-421C-A550-7FE15AB53ABF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F7BF047-03C5-4A60-B718-E222B16DBF41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E3A73D81-3E1A-42E6-AB96-835CDD5905F2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"66136D6D-FC52-40DB-B7B6-BA8B7758CE16\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"06514F46-544B-4404-B45C-C9584EBC3131\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3BD4BF9A-BF38-460D-974D-5B3255AAF946\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.1.0\", \"matchCriteriaId\": \"B7DB4831-F874-4D9D-AB58-BE4A554891EA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.0.0.0\", \"versionEndIncluding\": \"5.6.0.0\", \"matchCriteriaId\": \"B47C73D0-BE89-4D87-8765-12C507F13AFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5B8AA91A-1880-43CD-938D-48EF58ACF2CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A7506589-9B3B-49BA-B826-774BFDCC45B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"228DA523-4D6D-48C5-BDB0-DB1A60F23F8B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"335AB6A7-3B1F-4FA8-AF08-7D64C16C4B04\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0A735B4-4F3C-416B-8C08-9CB21BAD2889\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7E1E416B-920B-49A0-9523-382898C2979D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"12.2.0\", \"versionEndIncluding\": \"12.2.20\", \"matchCriteriaId\": \"15512D27-7BEB-4DDD-9A1B-447FC7156E3D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0DB5E2C7-9C68-4D3B-95AD-9CBF65DE1E94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"12.2.0\", \"versionEndIncluding\": \"12.2.20\", \"matchCriteriaId\": \"90F0B2AB-453C-4585-8753-74D17BD20C79\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"31C7EEA3-AA72-48DA-A112-2923DBB37773\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F0735989-13BD-40B3-B954-AC0529C5B53D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9EFAEA84-E376-40A2-8C9F-3E0676FEC527\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"959316A8-C3AF-4126-A242-3835ED0AD1E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BDB925C6-2CBC-4D88-B9EA-F246F4F7A206\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"98B9198C-11DF-4E80-ACFC-DC719CED8C7E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6953CFDB-33C0-4B8E-BBBD-E460A17E8ED3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B40B13B7-68B3-4510-968C-6A730EB46462\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C93CC705-1F8C-4870-99E6-14BF264C3811\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F14A818F-AA16-4438-A3E4-E64C9287AC66\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"04BCDC24-4A21-473C-8733-0D9CFB38A752\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD1FCB0D-3E19-4461-9330-4D7F02972A35\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"3.0\", \"versionEndIncluding\": \"3.1.3\", \"matchCriteriaId\": \"B9273745-6408-4CD3-94E8-9385D4F5FE69\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F4754FB-E3EB-454A-AB1A-AE3835C5350C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BDFB1169-41A0-4A86-8E4F-FDA9730B1E94\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6770B6C3-732E-4E22-BF1C-2D2FD610061C\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9F9C8C20-42EB-4AB5-BD97-212DEB070C43\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7FFF7106-ED78-49BA-9EC5-B889E3685D53\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E63D8B0F-006E-4801-BF9D-1C001BBFB4F9\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"56409CEC-5A1E-4450-AA42-641E459CC2AF\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B06F4839-D16A-4A61-9BB5-55B13F41E47F\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"108A2215-50FB-4074-94CF-C130FA14566D\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7AFC73CE-ABB9-42D3-9A71-3F5BC5381E0E\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"32F0B6C0-F930-480D-962B-3F4EFDCC13C7\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"803BC414-B250-4E3A-A478-A3881340D6B8\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0FEB3337-BFDE-462A-908B-176F92053CEC\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"736AEAE9-782B-4F71-9893-DED53367E102\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0B4AD8A-F172-4558-AEC6-FF424BA2D912\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8497A4C9-8474-4A62-8331-3FE862ED4098\"}]}]}, {\"operator\": \"AND\", \"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"234DEFE0-5CE5-4B0A-96B8-5D227CB8ED31\"}]}, {\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": false, \"criteria\": \"cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CDDF61B7-EC5C-467C-B710-B89F502CD04F\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B620311B-34A3-48A6-82DF-6F078D7A4493\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B009C22E-30A4-4288-BCF6-C3E81DEAF45A\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*\", \"versionEndExcluding\": \"6.0.9\", \"matchCriteriaId\": \"4ACF85D6-6B45-43DA-9C01-F0208186F014\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:agile_product_supplier_collaboration_for_process:6.2.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA6F2E4C-C935-40CF-972E-8C3D8A912134\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"18.1\", \"versionEndIncluding\": \"20.1\", \"matchCriteriaId\": \"59830587-A6B0-4642-B566-6FD8792F7716\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B796AC70-A220-48D8-B8CD-97CF57227962\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"790A89FD-6B86-49AE-9B4F-AE7262915E13\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E39D442D-1997-49AF-8B02-5640BE2A26CC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\\\\::*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.0\", \"versionEndIncluding\": \"8.2.2\", \"matchCriteriaId\": \"FAFED7F5-03FA-43B5-AD13-1130F0324448\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"726DB59B-00C7-444E-83F7-CB31032482AB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B095CC03-7077-4A58-AB25-CC5380CDCE5A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7015A8CB-8FA6-423E-8307-BD903244F517\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.1.0\", \"matchCriteriaId\": \"021014B2-DC51-481C-BCFE-5857EFBDEDDA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.8\", \"matchCriteriaId\": \"AD080793-FC45-4260-8E45-40E228F432FC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2ACA29E6-F393-46E5-B2B3-9158077819A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FCD1EC13-CC2F-4668-90D2-D8609066F2DF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4D614F76-0AA1-4EA8-A24A-38EFC90EF5DB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"39B8DFFF-B037-4F29-8C8E-F4BBC3435199\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4D0D0EAC-300D-44B1-AD4A-93A368D5DBA1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.8\", \"matchCriteriaId\": \"C5E0646D-4866-41FB-AE2E-5307B6F4004A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8A566893-8DCF-49E4-93D0-0ACCEFD70D3D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.8\", \"matchCriteriaId\": \"B37FC113-4F40-4D29-8712-7AD250373008\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"00E5D719-249D-48B8-BAFC-1E14D250B3F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.1.0\", \"matchCriteriaId\": \"712577A9-04D6-4579-A82B-72200E467399\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.9\", \"matchCriteriaId\": \"672949B4-1989-4AA7-806F-EEC07D07F317\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"987A0C35-4C7F-4FFB-B47B-37B69A32F879\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3B6BE3-4C5A-402F-832C-86A0A6234C25\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9476D1DA-C8A8-40A0-94DD-9B46C05FD461\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"34070F24-2E53-43EC-9117-E1434B2C4C2B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B9B2C2F6-235F-4E78-A299-18C041C05C9A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F727AAC6-6D9F-4B28-B07C-6A93916C43A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.8\", \"matchCriteriaId\": \"6662C783-5B5C-4559-89F5-1A681AA46A3E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"51C17460-D326-4525-A7D1-0AED53E75E18\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"37C8EE84-A840-4132-B331-C7D450B1FBBF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1D8436A2-9CA3-4C91-B632-9B03368ABC1B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A00142E6-EEB3-44BD-AB0D-0E5C5640557F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6149C89E-0111-4CF9-90CA-0662D2F75E04\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6CDDF6CA-6441-4606-9D2F-22A67BA46978\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6FA0B592-A216-4320-A4FE-ABCA6B3E7D7A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CEA4D6CF-D54A-40DF-9B70-E13392D0BE19\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.8\", \"matchCriteriaId\": \"2A333755-4B6E-4A0F-AC48-4CEA70CD5801\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"397B1A24-7C95-4A73-8363-4529A7F6CFCC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EF6D5112-4055-4F89-A5B3-0DCB109481B7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D262848E-AA24-4057-A747-6221BA22ADF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4A01F8ED-64DA-43BC-9C02-488010BCD0F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"75638A6A-88B2-4BC7-84EA-1CF5FC30D555\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"501B9331-6BB7-44BF-A664-180CAFABF88C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F2A3AE3C-8E24-4FB6-9954-9B50CBD59B21\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F8E565DA-91BE-44FC-A28F-579BE8D2281A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.1.0\", \"matchCriteriaId\": \"AED72F90-3B68-45AC-865C-110F7FD30D37\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"8.0.6\", \"versionEndIncluding\": \"8.0.9\", \"matchCriteriaId\": \"4F909C61-1A74-402C-B74F-BAF7297875B0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"26A1F27B-C3AC-4D13-B9B2-2D6CF65D07BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B95E8056-51D8-4390-ADE3-661B7AE1D7CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"609D6EDF-D4D0-4370-9B8B-CA39D41946C0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9059A907-508B-4844-8D7B-0FA68C0DF6A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2AC63D10-2326-4542-B345-31D45B9A7408\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F7BF047-03C5-4A60-B718-E222B16DBF41\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E3A73D81-3E1A-42E6-AB96-835CDD5905F2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:hospitality_simphony:19.1.0-19.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"351F9DE9-2FCE-4BCA-A098-CDFB07E6E4B9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"66136D6D-FC52-40DB-B7B6-BA8B7758CE16\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"06514F46-544B-4404-B45C-C9584EBC3131\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3BD4BF9A-BF38-460D-974D-5B3255AAF946\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_data_foundation:8.0.6-8.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D10745C6-2751-4FD0-BDFA-84C7AB8066BC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.0.0.0\", \"versionEndIncluding\": \"5.6.0.0\", \"matchCriteriaId\": \"B47C73D0-BE89-4D87-8765-12C507F13AFF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5B8AA91A-1880-43CD-938D-48EF58ACF2CF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A7506589-9B3B-49BA-B826-774BFDCC45B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"228DA523-4D6D-48C5-BDB0-DB1A60F23F8B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"335AB6A7-3B1F-4FA8-AF08-7D64C16C4B04\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0A735B4-4F3C-416B-8C08-9CB21BAD2889\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7E1E416B-920B-49A0-9523-382898C2979D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"12.2.0\", \"versionEndIncluding\": \"12.2.20\", \"matchCriteriaId\": \"15512D27-7BEB-4DDD-9A1B-447FC7156E3D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0DB5E2C7-9C68-4D3B-95AD-9CBF65DE1E94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"12.2.0\", \"versionEndIncluding\": \"12.2.20\", \"matchCriteriaId\": \"90F0B2AB-453C-4585-8753-74D17BD20C79\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"31C7EEA3-AA72-48DA-A112-2923DBB37773\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F0735989-13BD-40B3-B954-AC0529C5B53D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9EFAEA84-E376-40A2-8C9F-3E0676FEC527\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"959316A8-C3AF-4126-A242-3835ED0AD1E8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"BDB925C6-2CBC-4D88-B9EA-F246F4F7A206\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"98B9198C-11DF-4E80-ACFC-DC719CED8C7E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B40B13B7-68B3-4510-968C-6A730EB46462\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C93CC705-1F8C-4870-99E6-14BF264C3811\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F14A818F-AA16-4438-A3E4-E64C9287AC66\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"04BCDC24-4A21-473C-8733-0D9CFB38A752\"}]}]}]", "descriptions": "[{\"lang\": \"en\", \"value\": \"In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.\"}, {\"lang\": \"es\", \"value\": \"En las versiones de jQuery mayores o iguales a 1.2 y anteriores a la versi\\u00f3n 3.5.0, se puede ejecutar HTML desde fuentes no seguras, incluso despu\\u00e9s de desinfectarlo, a uno de los m\\u00e9todos de manipulaci\\u00f3n DOM de jQuery (es decir .html (), .append () y otros). c\\u00f3digo no seguro Este problema est\\u00e1 corregido en jQuery 3.5.0.\"}]", "id": "CVE-2020-11022", "lastModified": "2024-11-21T04:56:36.110", "metrics": "{\"cvssMetricV31\": [{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N\", \"baseScore\": 6.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 1.6, \"impactScore\": 4.7}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}", "published": "2020-04-29T22:15:11.903", "references": "[{\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://jquery.com/upgrade-guide/3.5/\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://security.gentoo.org/glsa/202007-03\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200511-0006/\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2020/dsa-4693\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.drupal.org/sa-core-2020-002\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com//security-alerts/cpujul2021.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2021.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2020.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2022.html\", \"source\": \"security-advisories@github.com\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2020.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2021.html\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2020-10\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2020-11\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-02\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-10\", \"source\": \"security-advisories@github.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Broken Link\"]}, {\"url\": \"http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Exploit\", \"Third Party Advisory\", \"VDB Entry\"]}, {\"url\": \"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Third Party Advisory\"]}, {\"url\": \"https://jquery.com/upgrade-guide/3.5/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mitigation\", \"Vendor Advisory\"]}, {\"url\": \"https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Mailing List\", \"Third Party Advisory\"]}, {\"url\": \"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://security.gentoo.org/glsa/202007-03\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://security.netapp.com/advisory/ntap-20200511-0006/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.debian.org/security/2020/dsa-4693\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.drupal.org/sa-core-2020-002\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com//security-alerts/cpujul2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuApr2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuapr2022.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujan2022.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpujul2022.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2020.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.oracle.com/security-alerts/cpuoct2021.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Patch\", \"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2020-10\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2020-11\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-02\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"https://www.tenable.com/security/tns-2021-10\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}]", "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": "[{\"source\": \"security-advisories@github.com\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}, {\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]" }, "nvd": "{\"cve\":{\"id\":\"CVE-2020-11022\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2020-04-29T22:15:11.903\",\"lastModified\":\"2024-11-21T04:56:36.110\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery\u0027s DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.\"},{\"lang\":\"es\",\"value\":\"En las versiones de jQuery mayores o iguales a 1.2 y anteriores a la versi\u00f3n 3.5.0, se puede ejecutar HTML desde fuentes no seguras, incluso despu\u00e9s de desinfectarlo, a uno de los m\u00e9todos de manipulaci\u00f3n DOM de jQuery (es decir .html (), .append () y otros). c\u00f3digo no seguro Este problema est\u00e1 corregido en jQuery 3.5.0.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:L/A:N\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.6,\"impactScore\":4.7},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"1.2\",\"versionEndExcluding\":\"3.5.0\",\"matchCriteriaId\":\"B5CFA4CA-5296-4B78-8D65-34FC63A09DEF\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"7.0\",\"versionEndExcluding\":\"7.70\",\"matchCriteriaId\":\"70C672EE-2027-4A29-8C14-3450DEF1462A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.7.0\",\"versionEndExcluding\":\"8.7.14\",\"matchCriteriaId\":\"BBFE42E2-6583-4EBE-B320-B8CF9CA0C3BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.8.0\",\"versionEndExcluding\":\"8.8.6\",\"matchCriteriaId\":\"7BA49DB0-ECC3-4155-B76C-0CA292600DE6\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DEECE5FC-CACF-4496-A3E7-164736409252\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"80F0FA5D-8D3B-4C0E-81E2-87998286AF33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"36D96259-24BD-44E2-96D9-78CE1D41F956\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E460AA51-FCDA-46B9-AE97-E6676AA5E194\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A079FD6E-3BB0-4997-9A8E-6F8FEC89887A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A125E817-F974-4509-872C-B71933F42AD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BBE7BF09-B89C-4590-821E-6C0587E096B5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"ADAE8A71-0BCD-42D5-B38C-9B2A27CC1E6B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7231D2D-4092-44F3-B60A-D7C9ED78AFDF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F7BDFC10-45A0-46D8-AB92-4A5E2C1C76ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"18127694-109C-4E7E-AE79-0BA351849291\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33F68878-BC19-4DB8-8A72-BD9FE3D0ACEC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"21.1.2\",\"matchCriteriaId\":\"D0DBC938-A782-433F-8BF1-CA250C332AA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B796AC70-A220-48D8-B8CD-97CF57227962\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"790A89FD-6B86-49AE-9B4F-AE7262915E13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E39D442D-1997-49AF-8B02-5640BE2A26CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\\\\::*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndIncluding\":\"8.2.2\",\"matchCriteriaId\":\"FAFED7F5-03FA-43B5-AD13-1130F0324448\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"16.1.0\",\"versionEndIncluding\":\"16.4.0\",\"matchCriteriaId\":\"1A0E3537-CB5A-40BF-B42C-CED9211B8892\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"062E4E7C-55BB-46F3-8B61-5A663B565891\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"726DB59B-00C7-444E-83F7-CB31032482AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B095CC03-7077-4A58-AB25-CC5380CDCE5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7015A8CB-8FA6-423E-8307-BD903244F517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6.0.0\",\"versionEndIncluding\":\"8.1.0.0.0\",\"matchCriteriaId\":\"F2BB6A71-6AF6-4C0B-9304-4111E32108D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.8\",\"matchCriteriaId\":\"AD080793-FC45-4260-8E45-40E228F432FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2ACA29E6-F393-46E5-B2B3-9158077819A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FCD1EC13-CC2F-4668-90D2-D8609066F2DF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D614F76-0AA1-4EA8-A24A-38EFC90EF5DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"39B8DFFF-B037-4F29-8C8E-F4BBC3435199\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D0D0EAC-300D-44B1-AD4A-93A368D5DBA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.8\",\"matchCriteriaId\":\"C5E0646D-4866-41FB-AE2E-5307B6F4004A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A566893-8DCF-49E4-93D0-0ACCEFD70D3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.8\",\"matchCriteriaId\":\"B37FC113-4F40-4D29-8712-7AD250373008\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"00E5D719-249D-48B8-BAFC-1E14D250B3F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.1.0\",\"matchCriteriaId\":\"712577A9-04D6-4579-A82B-72200E467399\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.9\",\"matchCriteriaId\":\"672949B4-1989-4AA7-806F-EEC07D07F317\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"987A0C35-4C7F-4FFB-B47B-37B69A32F879\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3B6BE3-4C5A-402F-832C-86A0A6234C25\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9476D1DA-C8A8-40A0-94DD-9B46C05FD461\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"34070F24-2E53-43EC-9117-E1434B2C4C2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9B2C2F6-235F-4E78-A299-18C041C05C9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F727AAC6-6D9F-4B28-B07C-6A93916C43A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.8\",\"matchCriteriaId\":\"6662C783-5B5C-4559-89F5-1A681AA46A3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51C17460-D326-4525-A7D1-0AED53E75E18\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"37C8EE84-A840-4132-B331-C7D450B1FBBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D8436A2-9CA3-4C91-B632-9B03368ABC1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A00142E6-EEB3-44BD-AB0D-0E5C5640557F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6149C89E-0111-4CF9-90CA-0662D2F75E04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CDDF6CA-6441-4606-9D2F-22A67BA46978\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6FA0B592-A216-4320-A4FE-ABCA6B3E7D7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CEA4D6CF-D54A-40DF-9B70-E13392D0BE19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.8\",\"matchCriteriaId\":\"2A333755-4B6E-4A0F-AC48-4CEA70CD5801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"397B1A24-7C95-4A73-8363-4529A7F6CFCC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF6D5112-4055-4F89-A5B3-0DCB109481B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D262848E-AA24-4057-A747-6221BA22ADF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A01F8ED-64DA-43BC-9C02-488010BCD0F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"75638A6A-88B2-4BC7-84EA-1CF5FC30D555\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"501B9331-6BB7-44BF-A664-180CAFABF88C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F2A3AE3C-8E24-4FB6-9954-9B50CBD59B21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8E565DA-91BE-44FC-A28F-579BE8D2281A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.1.0\",\"matchCriteriaId\":\"AED72F90-3B68-45AC-865C-110F7FD30D37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.9\",\"matchCriteriaId\":\"4F909C61-1A74-402C-B74F-BAF7297875B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26A1F27B-C3AC-4D13-B9B2-2D6CF65D07BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B95E8056-51D8-4390-ADE3-661B7AE1D7CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"609D6EDF-D4D0-4370-9B8B-CA39D41946C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9059A907-508B-4844-8D7B-0FA68C0DF6A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2AC63D10-2326-4542-B345-31D45B9A7408\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"19.1.0\",\"versionEndIncluding\":\"19.1.2\",\"matchCriteriaId\":\"7BFD7783-BE15-421C-A550-7FE15AB53ABF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F7BF047-03C5-4A60-B718-E222B16DBF41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3A73D81-3E1A-42E6-AB96-835CDD5905F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"66136D6D-FC52-40DB-B7B6-BA8B7758CE16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06514F46-544B-4404-B45C-C9584EBC3131\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3BD4BF9A-BF38-460D-974D-5B3255AAF946\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.1.0\",\"matchCriteriaId\":\"B7DB4831-F874-4D9D-AB58-BE4A554891EA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.0.0\",\"versionEndIncluding\":\"5.6.0.0\",\"matchCriteriaId\":\"B47C73D0-BE89-4D87-8765-12C507F13AFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5B8AA91A-1880-43CD-938D-48EF58ACF2CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7506589-9B3B-49BA-B826-774BFDCC45B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"228DA523-4D6D-48C5-BDB0-DB1A60F23F8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"335AB6A7-3B1F-4FA8-AF08-7D64C16C4B04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0A735B4-4F3C-416B-8C08-9CB21BAD2889\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E1E416B-920B-49A0-9523-382898C2979D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.2.0\",\"versionEndIncluding\":\"12.2.20\",\"matchCriteriaId\":\"15512D27-7BEB-4DDD-9A1B-447FC7156E3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0DB5E2C7-9C68-4D3B-95AD-9CBF65DE1E94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.2.0\",\"versionEndIncluding\":\"12.2.20\",\"matchCriteriaId\":\"90F0B2AB-453C-4585-8753-74D17BD20C79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31C7EEA3-AA72-48DA-A112-2923DBB37773\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0735989-13BD-40B3-B954-AC0529C5B53D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EFAEA84-E376-40A2-8C9F-3E0676FEC527\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"959316A8-C3AF-4126-A242-3835ED0AD1E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDB925C6-2CBC-4D88-B9EA-F246F4F7A206\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98B9198C-11DF-4E80-ACFC-DC719CED8C7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6953CFDB-33C0-4B8E-BBBD-E460A17E8ED3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B40B13B7-68B3-4510-968C-6A730EB46462\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C93CC705-1F8C-4870-99E6-14BF264C3811\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F14A818F-AA16-4438-A3E4-E64C9287AC66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04BCDC24-4A21-473C-8733-0D9CFB38A752\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD1FCB0D-3E19-4461-9330-4D7F02972A35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F1BE6C1F-2565-4E97-92AA-16563E5660A5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"3.0\",\"versionEndIncluding\":\"3.1.3\",\"matchCriteriaId\":\"B9273745-6408-4CD3-94E8-9385D4F5FE69\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F4754FB-E3EB-454A-AB1A-AE3835C5350C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDFB1169-41A0-4A86-8E4F-FDA9730B1E94\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6770B6C3-732E-4E22-BF1C-2D2FD610061C\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9F9C8C20-42EB-4AB5-BD97-212DEB070C43\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7FFF7106-ED78-49BA-9EC5-B889E3685D53\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E63D8B0F-006E-4801-BF9D-1C001BBFB4F9\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"56409CEC-5A1E-4450-AA42-641E459CC2AF\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B06F4839-D16A-4A61-9BB5-55B13F41E47F\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"108A2215-50FB-4074-94CF-C130FA14566D\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7AFC73CE-ABB9-42D3-9A71-3F5BC5381E0E\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32F0B6C0-F930-480D-962B-3F4EFDCC13C7\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"803BC414-B250-4E3A-A478-A3881340D6B8\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0FEB3337-BFDE-462A-908B-176F92053CEC\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"736AEAE9-782B-4F71-9893-DED53367E102\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0B4AD8A-F172-4558-AEC6-FF424BA2D912\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8497A4C9-8474-4A62-8331-3FE862ED4098\"}]}]},{\"operator\":\"AND\",\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"234DEFE0-5CE5-4B0A-96B8-5D227CB8ED31\"}]},{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":false,\"criteria\":\"cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CDDF61B7-EC5C-467C-B710-B89F502CD04F\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B620311B-34A3-48A6-82DF-6F078D7A4493\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:opensuse:leap:15.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B009C22E-30A4-4288-BCF6-C3E81DEAF45A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"6.0.9\",\"matchCriteriaId\":\"4ACF85D6-6B45-43DA-9C01-F0208186F014\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:agile_product_supplier_collaboration_for_process:6.2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA6F2E4C-C935-40CF-972E-8C3D8A912134\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"18.1\",\"versionEndIncluding\":\"20.1\",\"matchCriteriaId\":\"59830587-A6B0-4642-B566-6FD8792F7716\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B796AC70-A220-48D8-B8CD-97CF57227962\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"790A89FD-6B86-49AE-9B4F-AE7262915E13\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E39D442D-1997-49AF-8B02-5640BE2A26CC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\\\\::*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.0\",\"versionEndIncluding\":\"8.2.2\",\"matchCriteriaId\":\"FAFED7F5-03FA-43B5-AD13-1130F0324448\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"726DB59B-00C7-444E-83F7-CB31032482AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B095CC03-7077-4A58-AB25-CC5380CDCE5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7015A8CB-8FA6-423E-8307-BD903244F517\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.1.0\",\"matchCriteriaId\":\"021014B2-DC51-481C-BCFE-5857EFBDEDDA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.8\",\"matchCriteriaId\":\"AD080793-FC45-4260-8E45-40E228F432FC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2ACA29E6-F393-46E5-B2B3-9158077819A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FCD1EC13-CC2F-4668-90D2-D8609066F2DF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D614F76-0AA1-4EA8-A24A-38EFC90EF5DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"39B8DFFF-B037-4F29-8C8E-F4BBC3435199\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4D0D0EAC-300D-44B1-AD4A-93A368D5DBA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.8\",\"matchCriteriaId\":\"C5E0646D-4866-41FB-AE2E-5307B6F4004A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A566893-8DCF-49E4-93D0-0ACCEFD70D3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.8\",\"matchCriteriaId\":\"B37FC113-4F40-4D29-8712-7AD250373008\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"00E5D719-249D-48B8-BAFC-1E14D250B3F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.1.0\",\"matchCriteriaId\":\"712577A9-04D6-4579-A82B-72200E467399\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.9\",\"matchCriteriaId\":\"672949B4-1989-4AA7-806F-EEC07D07F317\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"987A0C35-4C7F-4FFB-B47B-37B69A32F879\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3B6BE3-4C5A-402F-832C-86A0A6234C25\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9476D1DA-C8A8-40A0-94DD-9B46C05FD461\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"34070F24-2E53-43EC-9117-E1434B2C4C2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B9B2C2F6-235F-4E78-A299-18C041C05C9A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F727AAC6-6D9F-4B28-B07C-6A93916C43A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.8\",\"matchCriteriaId\":\"6662C783-5B5C-4559-89F5-1A681AA46A3E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"51C17460-D326-4525-A7D1-0AED53E75E18\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"37C8EE84-A840-4132-B331-C7D450B1FBBF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D8436A2-9CA3-4C91-B632-9B03368ABC1B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A00142E6-EEB3-44BD-AB0D-0E5C5640557F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6149C89E-0111-4CF9-90CA-0662D2F75E04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6CDDF6CA-6441-4606-9D2F-22A67BA46978\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6FA0B592-A216-4320-A4FE-ABCA6B3E7D7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CEA4D6CF-D54A-40DF-9B70-E13392D0BE19\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.8\",\"matchCriteriaId\":\"2A333755-4B6E-4A0F-AC48-4CEA70CD5801\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"397B1A24-7C95-4A73-8363-4529A7F6CFCC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EF6D5112-4055-4F89-A5B3-0DCB109481B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D262848E-AA24-4057-A747-6221BA22ADF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A01F8ED-64DA-43BC-9C02-488010BCD0F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"75638A6A-88B2-4BC7-84EA-1CF5FC30D555\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"501B9331-6BB7-44BF-A664-180CAFABF88C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F2A3AE3C-8E24-4FB6-9954-9B50CBD59B21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8E565DA-91BE-44FC-A28F-579BE8D2281A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.1.0\",\"matchCriteriaId\":\"AED72F90-3B68-45AC-865C-110F7FD30D37\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"8.0.6\",\"versionEndIncluding\":\"8.0.9\",\"matchCriteriaId\":\"4F909C61-1A74-402C-B74F-BAF7297875B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"26A1F27B-C3AC-4D13-B9B2-2D6CF65D07BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B95E8056-51D8-4390-ADE3-661B7AE1D7CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"609D6EDF-D4D0-4370-9B8B-CA39D41946C0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9059A907-508B-4844-8D7B-0FA68C0DF6A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2AC63D10-2326-4542-B345-31D45B9A7408\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F7BF047-03C5-4A60-B718-E222B16DBF41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3A73D81-3E1A-42E6-AB96-835CDD5905F2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:hospitality_simphony:19.1.0-19.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"351F9DE9-2FCE-4BCA-A098-CDFB07E6E4B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"66136D6D-FC52-40DB-B7B6-BA8B7758CE16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06514F46-544B-4404-B45C-C9584EBC3131\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3BD4BF9A-BF38-460D-974D-5B3255AAF946\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_data_foundation:8.0.6-8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D10745C6-2751-4FD0-BDFA-84C7AB8066BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.0.0.0\",\"versionEndIncluding\":\"5.6.0.0\",\"matchCriteriaId\":\"B47C73D0-BE89-4D87-8765-12C507F13AFF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5B8AA91A-1880-43CD-938D-48EF58ACF2CF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A7506589-9B3B-49BA-B826-774BFDCC45B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"228DA523-4D6D-48C5-BDB0-DB1A60F23F8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"335AB6A7-3B1F-4FA8-AF08-7D64C16C4B04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0A735B4-4F3C-416B-8C08-9CB21BAD2889\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E1E416B-920B-49A0-9523-382898C2979D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.2.0\",\"versionEndIncluding\":\"12.2.20\",\"matchCriteriaId\":\"15512D27-7BEB-4DDD-9A1B-447FC7156E3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0DB5E2C7-9C68-4D3B-95AD-9CBF65DE1E94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.2.0\",\"versionEndIncluding\":\"12.2.20\",\"matchCriteriaId\":\"90F0B2AB-453C-4585-8753-74D17BD20C79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31C7EEA3-AA72-48DA-A112-2923DBB37773\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F0735989-13BD-40B3-B954-AC0529C5B53D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EFAEA84-E376-40A2-8C9F-3E0676FEC527\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"959316A8-C3AF-4126-A242-3835ED0AD1E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BDB925C6-2CBC-4D88-B9EA-F246F4F7A206\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98B9198C-11DF-4E80-ACFC-DC719CED8C7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B40B13B7-68B3-4510-968C-6A730EB46462\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C93CC705-1F8C-4870-99E6-14BF264C3811\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F14A818F-AA16-4438-A3E4-E64C9287AC66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"04BCDC24-4A21-473C-8733-0D9CFB38A752\"}]}]}],\"references\":[{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://jquery.com/upgrade-guide/3.5/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://security.gentoo.org/glsa/202007-03\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200511-0006/\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4693\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.drupal.org/sa-core-2020-002\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2022.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2022.html\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-10\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-11\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-02\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-10\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00067.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00085.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2020-11/msg00039.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Broken Link\"]},{\"url\":\"http://packetstormsecurity.com/files/162159/jQuery-1.2-Cross-Site-Scripting.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Third Party Advisory\",\"VDB Entry\"]},{\"url\":\"https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://github.com/jquery/jquery/commit/1d61fd9407e6fbe82fe55cb0b938307aa0791f77\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://github.com/jquery/jquery/security/advisories/GHSA-gxr4-xjj5-5px2\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Third Party Advisory\"]},{\"url\":\"https://jquery.com/upgrade-guide/3.5/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.apache.org/thread.html/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.debian.org/debian-lts-announce/2021/03/msg00033.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2023/08/msg00040.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://security.gentoo.org/glsa/202007-03\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://security.netapp.com/advisory/ntap-20200511-0006/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.debian.org/security/2020/dsa-4693\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.drupal.org/sa-core-2020-002\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujul2022.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2020.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2020-11\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-02\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://www.tenable.com/security/tns-2021-10\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
rhsa-2020_3807
Vulnerability from csaf_redhat
Published
2020-09-23 16:12
Modified
2024-11-24 20:21
Summary
Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update
Notes
Topic
An update is now available for Red Hat Virtualization Engine 4.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The org.ovirt.engine-root is a core component of oVirt.
The following packages have been upgraded to a later upstream version: ansible-runner-service (1.0.5), org.ovirt.engine-root (4.4.2.3), ovirt-engine-dwh (4.4.2.1), ovirt-engine-extension-aaa-ldap (1.4.1), ovirt-engine-ui-extensions (1.2.3), ovirt-log-collector (4.4.3), ovirt-web-ui (1.6.4), rhvm-branding-rhv (4.4.5), rhvm-dependencies (4.4.1), vdsm-jsonrpc-java (1.5.5). (BZ#1674420, BZ#1866734)
A list of bugs fixed in this update is available in the Technical Notes
book:
https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes
Security Fix(es):
* nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* ovirt-engine: Reflected cross site scripting vulnerability (CVE-2020-14333)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Bug Fix(es):
* Cannot assign direct LUN from FC storage - grayed out (BZ#1625499)
* VM portal always asks how to open console.vv even it has been set to default application. (BZ#1638217)
* RESTAPI Not able to remove the QoS from a disk profile (BZ#1643520)
* On OVA import, qemu-img fails to write to NFS storage domain (BZ#1748879)
* Possible missing block path for a SCSI host device needs to be handled in the UI (BZ#1801206)
* Scheduling Memory calculation disregards huge-pages (BZ#1804037)
* Engine does not reduce scheduling memory when a VM with dynamic hugepages runs. (BZ#1804046)
* In Admin Portal, "Huge Pages (size: amount)" needs to be clarified (BZ#1806339)
* Refresh LUN is using host from different Data Center to scan the LUN (BZ#1838051)
* Unable to create Windows VM's with Mozilla Firefox version 74.0.1 and greater for RHV-M GUI/Webadmin portal (BZ#1843234)
* [RHV-CNV] - NPE when creating new VM in cnv cluster (BZ#1854488)
* [CNV&RHV] Add-Disk operation failed to complete. (BZ#1855377)
* Cannot create KubeVirt VM as a normal user (BZ#1859460)
* Welcome page - remove Metrics Store links and update "Insights Guide" link (BZ#1866466)
* [RHV 4.4] Change in CPU model name after RHVH upgrade (BZ#1869209)
* VM vm-name is down with error. Exit message: unsupported configuration: Can't add USB input device. USB bus is disabled. (BZ#1871235)
* spec_ctrl host feature not detected (BZ#1875609)
Enhancement(s):
* [RFE] API for changed blocks/sectors for a disk for incremental backup usage (BZ#1139877)
* [RFE] Improve workflow for storage migration of VMs with multiple disks (BZ#1749803)
* [RFE] Move the Remove VM button to the drop down menu when viewing details such as snapshots (BZ#1763812)
* [RFE] enhance search filter for Storage Domains with free argument (BZ#1819260)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat Virtualization Engine 4.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The org.ovirt.engine-root is a core component of oVirt.\n\nThe following packages have been upgraded to a later upstream version: ansible-runner-service (1.0.5), org.ovirt.engine-root (4.4.2.3), ovirt-engine-dwh (4.4.2.1), ovirt-engine-extension-aaa-ldap (1.4.1), ovirt-engine-ui-extensions (1.2.3), ovirt-log-collector (4.4.3), ovirt-web-ui (1.6.4), rhvm-branding-rhv (4.4.5), rhvm-dependencies (4.4.1), vdsm-jsonrpc-java (1.5.5). (BZ#1674420, BZ#1866734)\n\nA list of bugs fixed in this update is available in the Technical Notes\nbook:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes\n\nSecurity Fix(es):\n\n* nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n\n* ovirt-engine: Reflected cross site scripting vulnerability (CVE-2020-14333)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Cannot assign direct LUN from FC storage - grayed out (BZ#1625499)\n\n* VM portal always asks how to open console.vv even it has been set to default application. (BZ#1638217)\n\n* RESTAPI Not able to remove the QoS from a disk profile (BZ#1643520)\n\n* On OVA import, qemu-img fails to write to NFS storage domain (BZ#1748879)\n\n* Possible missing block path for a SCSI host device needs to be handled in the UI (BZ#1801206)\n\n* Scheduling Memory calculation disregards huge-pages (BZ#1804037)\n\n* Engine does not reduce scheduling memory when a VM with dynamic hugepages runs. (BZ#1804046)\n\n* In Admin Portal, \"Huge Pages (size: amount)\" needs to be clarified (BZ#1806339)\n\n* Refresh LUN is using host from different Data Center to scan the LUN (BZ#1838051)\n\n* Unable to create Windows VM\u0027s with Mozilla Firefox version 74.0.1 and greater for RHV-M GUI/Webadmin portal (BZ#1843234)\n\n* [RHV-CNV] - NPE when creating new VM in cnv cluster (BZ#1854488)\n\n* [CNV\u0026RHV] Add-Disk operation failed to complete. (BZ#1855377)\n\n* Cannot create KubeVirt VM as a normal user (BZ#1859460)\n\n* Welcome page - remove Metrics Store links and update \"Insights Guide\" link (BZ#1866466)\n\n* [RHV 4.4] Change in CPU model name after RHVH upgrade (BZ#1869209)\n\n* VM vm-name is down with error. Exit message: unsupported configuration: Can\u0027t add USB input device. USB bus is disabled. (BZ#1871235)\n\n* spec_ctrl host feature not detected (BZ#1875609)\n\nEnhancement(s):\n\n* [RFE] API for changed blocks/sectors for a disk for incremental backup usage (BZ#1139877)\n\n* [RFE] Improve workflow for storage migration of VMs with multiple disks (BZ#1749803)\n\n* [RFE] Move the Remove VM button to the drop down menu when viewing details such as snapshots (BZ#1763812)\n\n* [RFE] enhance search filter for Storage Domains with free argument (BZ#1819260)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:3807", "url": "https://access.redhat.com/errata/RHSA-2020:3807" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1625499", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1625499" }, { "category": "external", "summary": "1638217", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1638217" }, { "category": "external", "summary": "1643520", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1643520" }, { "category": "external", "summary": "1674420", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1674420" }, { "category": "external", "summary": "1748879", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1748879" }, { "category": "external", "summary": "1749803", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749803" }, { "category": "external", "summary": "1758024", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1758024" }, { "category": "external", "summary": "1763812", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1763812" }, { "category": "external", "summary": "1778471", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1778471" }, { "category": "external", "summary": "1787854", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1787854" }, { "category": "external", "summary": "1801206", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801206" }, { "category": "external", "summary": "1803856", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1803856" }, { "category": "external", "summary": "1804037", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1804037" }, { "category": "external", "summary": "1804046", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1804046" }, { "category": "external", "summary": "1806339", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1806339" }, { "category": "external", "summary": "1816951", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816951" }, { "category": "external", "summary": "1819260", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819260" }, { "category": "external", "summary": "1826255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826255" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1831949", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1831949" }, { "category": "external", "summary": "1831952", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1831952" }, { "category": "external", "summary": "1831954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1831954" }, { "category": "external", "summary": "1831956", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1831956" }, { "category": "external", "summary": "1838051", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1838051" }, { "category": "external", "summary": "1841112", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1841112" }, { "category": "external", "summary": "1843234", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843234" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "1854488", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1854488" }, { "category": "external", "summary": "1855377", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1855377" }, { "category": "external", "summary": "1857412", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857412" }, { "category": "external", "summary": "1858184", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1858184" }, { "category": "external", "summary": "1859460", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1859460" }, { "category": "external", "summary": "1860907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860907" }, { "category": "external", "summary": "1866466", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1866466" }, { "category": "external", "summary": "1866734", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1866734" }, { "category": "external", "summary": "1869209", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869209" }, { "category": "external", "summary": "1869302", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869302" }, { "category": "external", "summary": "1871235", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1871235" }, { "category": "external", "summary": "1875609", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1875609" }, { "category": "external", "summary": "1875851", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1875851" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3807.json" } ], "title": "Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-24T20:21:20+00:00", "generator": { "date": "2024-11-24T20:21:20+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:3807", "initial_release_date": "2020-09-23T16:12:36+00:00", "revision_history": [ { "date": "2020-09-23T16:12:36+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-09-23T16:12:36+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-24T20:21:20+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product": { "name": "RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhev_manager:4.4:el8" } } } ], "category": "product_family", "name": "Red Hat Virtualization" }, { "branches": [ { "category": "product_version", "name": "ansible-runner-service-0:1.0.5-1.el8ev.noarch", "product": { "name": "ansible-runner-service-0:1.0.5-1.el8ev.noarch", "product_id": "ansible-runner-service-0:1.0.5-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ansible-runner-service@1.0.5-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "product": { "name": "ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "product_id": "ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-log-collector@4.4.3-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "product": { "name": "rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "product_id": "rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-dependencies@4.4.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "product": { "name": "vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "product_id": "vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/vdsm-jsonrpc-java@1.5.5-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "product": { "name": "rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "product_id": "rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-branding-rhv@4.4.5-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "product": { "name": "ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "product_id": "ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-ui-extensions@1.2.3-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "product": { "name": "ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "product_id": "ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-web-ui@1.6.4-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "product": { "name": "ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "product_id": "ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dwh@4.4.2.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "product": { "name": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "product_id": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dwh-grafana-integration-setup@4.4.2.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "product": { "name": "ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "product_id": "ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dwh-setup@4.4.2.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-backend@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dbscripts@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-health-check-bundler@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-restapi@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-base@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-cinderlib@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-imageio@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-ovirt-engine@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-ovirt-engine-common@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-vmconsole-proxy-helper@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-websocket-proxy@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-tools@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-tools-backup@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-vmconsole-proxy-helper@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-webadmin-portal@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-websocket-proxy@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-ovirt-engine-lib@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "rhvm-0:4.4.2.3-0.6.el8ev.noarch", "product": { "name": "rhvm-0:4.4.2.3-0.6.el8ev.noarch", "product_id": "rhvm-0:4.4.2.3-0.6.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm@4.4.2.3-0.6.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "product": { "name": "ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "product_id": "ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-ldap@1.4.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "product": { "name": "ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "product_id": "ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-ldap-setup@1.4.1-1.el8ev?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "ansible-runner-service-0:1.0.5-1.el8ev.src", "product": { "name": "ansible-runner-service-0:1.0.5-1.el8ev.src", "product_id": "ansible-runner-service-0:1.0.5-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ansible-runner-service@1.0.5-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-log-collector-0:4.4.3-1.el8ev.src", "product": { "name": "ovirt-log-collector-0:4.4.3-1.el8ev.src", "product_id": "ovirt-log-collector-0:4.4.3-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-log-collector@4.4.3-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "rhvm-dependencies-0:4.4.1-1.el8ev.src", "product": { "name": "rhvm-dependencies-0:4.4.1-1.el8ev.src", "product_id": "rhvm-dependencies-0:4.4.1-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-dependencies@4.4.1-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src", "product": { "name": "vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src", "product_id": "vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/vdsm-jsonrpc-java@1.5.5-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "product": { "name": "rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "product_id": "rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-branding-rhv@4.4.5-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "product": { "name": "ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "product_id": "ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-ui-extensions@1.2.3-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-web-ui-0:1.6.4-1.el8ev.src", "product": { "name": "ovirt-web-ui-0:1.6.4-1.el8ev.src", "product_id": "ovirt-web-ui-0:1.6.4-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-web-ui@1.6.4-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "product": { "name": "ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "product_id": "ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dwh@4.4.2.1-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "product": { "name": "ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "product_id": "ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine@4.4.2.3-0.6.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "product": { "name": "ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "product_id": "ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-ldap@1.4.1-1.el8ev?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ansible-runner-service-0:1.0.5-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.noarch" }, "product_reference": "ansible-runner-service-0:1.0.5-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-runner-service-0:1.0.5-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.src" }, "product_reference": "ansible-runner-service-0:1.0.5-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-0:4.4.2.3-0.6.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.src" }, "product_reference": "ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch" }, "product_reference": "ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src" }, "product_reference": "ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch" }, "product_reference": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch" }, "product_reference": "ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch" }, "product_reference": "ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src" }, "product_reference": "ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch" }, "product_reference": "ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch" }, "product_reference": "ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src" }, "product_reference": "ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-log-collector-0:4.4.3-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.noarch" }, "product_reference": "ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-log-collector-0:4.4.3-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.src" }, "product_reference": "ovirt-log-collector-0:4.4.3-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-web-ui-0:1.6.4-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch" }, "product_reference": "ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-web-ui-0:1.6.4-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src" }, "product_reference": "ovirt-web-ui-0:1.6.4-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-0:4.4.2.3-0.6.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-0:4.4.2.3-0.6.el8ev.noarch" }, "product_reference": "rhvm-0:4.4.2.3-0.6.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch" }, "product_reference": "rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-branding-rhv-0:4.4.5-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.src" }, "product_reference": "rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-dependencies-0:4.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.noarch" }, "product_reference": "rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-dependencies-0:4.4.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.src" }, "product_reference": "rhvm-dependencies-0:4.4.1-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch" }, "product_reference": "vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src" }, "product_reference": "vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-8203", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-07-15T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.src", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.src", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1857412" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-lodash in versions 4.17.15 and earlier. A prototype pollution attack is possible which can lead to arbitrary code execution. The primary threat from this vulnerability is to data integrity and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-lodash: prototype pollution in zipObjectDeep function", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift ServiceMesh (OSSM), Red Hat OpenShift Jaeger (RHOSJ) and Red Hat OpenShift Container Platform (RHOCP), the affected containers are behind OpenShift OAuth authentication. This restricts access to the vulnerable nodejs-lodash library to authenticated users only, therefore the impact is low.\n\nRed Hat OpenShift Container Platform 4 delivers the kibana package where the nodejs-lodash library is used, but due to the code changing to the container first content the kibana package is marked as wontfix. This may be fixed in the future.\n\nRed Hat Virtualization uses vulnerable version of nodejs-lodash, however zipObjectDeep is not used, therefore the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.src", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.src", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8203" }, { "category": "external", "summary": "RHBZ#1857412", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857412" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8203", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8203" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8203", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8203" }, { "category": "external", "summary": "https://hackerone.com/reports/712065", "url": "https://hackerone.com/reports/712065" }, { "category": "external", "summary": "https://www.npmjs.com/advisories/1523", "url": "https://www.npmjs.com/advisories/1523" } ], "release_date": "2020-04-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-09-23T16:12:36+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3807" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-lodash: prototype pollution in zipObjectDeep function" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.src", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.src", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.src", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.src", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-09-23T16:12:36+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3807" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.src", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.src", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. However, the vulnerability has not been found to be exploitable in reasonable scenarios. \n\nIn RHEL7, pcs-0.9.169-3.el7_9.3 [RHSA-2022:7343] contains an updated version of jquery (3.6.0), which does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.src", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.src", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-09-23T16:12:36+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3807" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "acknowledgments": [ { "names": [ "Chen Huiliang", "Chen RuiQi" ], "organization": "Qianxin CodeSafe Team" } ], "cve": "CVE-2020-14333", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-07-16T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.src", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1858184" } ], "notes": [ { "category": "description", "text": "A flaw was found in the web interface of ovirt-engine 4.4.2 and earlier, where it did not filter user-controllable parameters completely, resulting in a reflected cross-site scripting attack. This flaw allows an attacker to leverage a phishing attack, steal an unsuspecting user\u0027s cookies or other confidential information, or impersonate them within the application\u0027s context.", "title": "Vulnerability description" }, { "category": "summary", "text": "ovirt-engine: Reflected cross site scripting vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.2.3-0.6.el8ev.noarch" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.5-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.2.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.2.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.3-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.5-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.1-1.el8ev.src", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.5-1.el8ev.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-14333" }, { "category": "external", "summary": "RHBZ#1858184", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1858184" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-14333", "url": "https://www.cve.org/CVERecord?id=CVE-2020-14333" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-14333", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-14333" } ], "release_date": "2020-08-17T09:30:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-09-23T16:12:36+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.2.3-0.6.el8ev.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3807" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.2.3-0.6.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.2.3-0.6.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.2.3-0.6.el8ev.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ovirt-engine: Reflected cross site scripting vulnerability" } ] }
rhsa-2021:0778
Vulnerability from csaf_redhat
Published
2021-03-09 15:50
Modified
2025-07-10 20:16
Summary
Red Hat Security Advisory: Red Hat Ansible Tower 3.6.7-1 - Container security and bug fix update
Notes
Topic
Red Hat Ansible Tower 3.6.7-1 - RHEL7 Container
Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Security Fix(es):
* Addressed a security issue which can allow a malicious playbook author to elevate to the awx user from outside the isolated environment: CVE-2021-20253
* Upgraded to a more recent version of nginx to address CVE-2019-20372
* Upgraded to a more recent version of autobahn to address CVE-2020-35678
* Upgraded to a more recent version of jquery to address CVE-2020-11022 and CVE-2020-11023
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat Ansible Tower 3.6.7-1 - RHEL7 Container\n\nRed Hat Product Security has rated this update as having a security impact of\nImportant. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Security Fix(es):\n\n* Addressed a security issue which can allow a malicious playbook author to elevate to the awx user from outside the isolated environment: CVE-2021-20253\n* Upgraded to a more recent version of nginx to address CVE-2019-20372\n* Upgraded to a more recent version of autobahn to address CVE-2020-35678\n* Upgraded to a more recent version of jquery to address CVE-2020-11022 and CVE-2020-11023\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2021:0778", "url": "https://access.redhat.com/errata/RHSA-2021:0778" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1790277", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790277" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "1911314", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1911314" }, { "category": "external", "summary": "1928847", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928847" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0778.json" } ], "title": "Red Hat Security Advisory: Red Hat Ansible Tower 3.6.7-1 - Container security and bug fix update", "tracking": { "current_release_date": "2025-07-10T20:16:29+00:00", "generator": { "date": "2025-07-10T20:16:29+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2021:0778", "initial_release_date": "2021-03-09T15:50:37+00:00", "revision_history": [ { "date": "2021-03-09T15:50:37+00:00", "number": "1", "summary": "Initial version" }, { "date": "2021-03-09T15:50:37+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-10T20:16:29+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Ansible Tower 3.6 for RHEL 7", "product": { "name": "Red Hat Ansible Tower 3.6 for RHEL 7", "product_id": "7Server-Ansible-Tower-3.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:ansible_tower:3.6::el7" } } } ], "category": "product_family", "name": "Red Hat Ansible Tower" }, { "branches": [ { "category": "product_version", "name": "ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64", "product": { "name": "ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64", "product_id": "ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64", "product_identification_helper": { "purl": "pkg:oci/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28?arch=amd64\u0026repository_url=registry.redhat.io/ansible-tower-36/ansible-tower\u0026tag=3.6.7-1" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64 as a component of Red Hat Ansible Tower 3.6 for RHEL 7", "product_id": "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" }, "product_reference": "ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64", "relates_to_product_reference": "7Server-Ansible-Tower-3.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-20372", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2020-01-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1790277" } ], "notes": [ { "category": "description", "text": "NGINX before 1.17.7, with certain error_page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.", "title": "Vulnerability description" }, { "category": "summary", "text": "nginx: HTTP request smuggling in configurations with URL redirect used as error_page", "title": "Vulnerability summary" }, { "category": "other", "text": "Ansible Tower 3.5 and 3.6 are not vulnerable by default as are not using error_page variable in the nginx configuration. However, Ansible Tower 3.5 and 3.6 are distributing nginx 1.14 and 1.16 vulnerable versions as a dependency and configuration could be modified making it vulnerable.\n\nRed Hat CloudForms Management Engine 5.9 and 5.10 are not vulnerable by default as are not using error_page variable in the nginx configuration. However, both mentioned builds ships vulnerable nginx versions 1.10 and 1.14 respectively. CloudForms 5.11 does not use nginx directly hence it is not vulnerable.\n\nRed Hat Quay\u0027s configuration of nginx means it\u0027s not affected by this issue. It doesn\u0027t use error_page to do a 302 redirect. It\u0027s only use of error_page uses a named location ie:\nerror_page 404 /404.html;\n location = /40x.html {\n }\nerror_page 500 502 503 504 /50x.html;\n location = /50x.html {\n}", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-20372" }, { "category": "external", "summary": "RHBZ#1790277", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790277" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-20372", "url": "https://www.cve.org/CVERecord?id=CVE-2019-20372" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20372", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20372" } ], "release_date": "2020-01-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-03-09T15:50:37+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0778" }, { "category": "workaround", "details": "To mitigate this issue, use a named location instead of having the error_page handler do the redirect, this configuration is not vulnerable to request smuggling on all versions of NGINX we tested.\nserver {\n listen 80;\n server_name localhost;\n error_page 401 @401;\n location / {\n return 401;\n }\n location @401 {\n return 302 http://example.org;\n }\n}", "product_ids": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nginx: HTTP request smuggling in configurations with URL redirect used as error_page" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-03-09T15:50:37+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0778" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis controls ensure that security flaws, including XSS vulnerabilities, are detected early in development by scanning code for improper input handling. This prevents vulnerable code from reaching production and encourages our developers to follow secure coding practices. System monitoring controls play a crucial role in detecting and responding to XSS attacks by analyzing logs, monitoring user behavior, and generating alerts for suspicious activity. Meanwhile, AWS WAF (Web Application Firewall) adds an extra layer of defense by filtering and blocking malicious input before it reaches the platform and/or application. Together, these controls create a defense-in-depth approach, reducing the risk of XSS exploitation by preventing, detecting, and mitigating attacks at multiple levels.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-03-09T15:50:37+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0778" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.", "product_ids": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] } ], "threats": [ { "category": "exploit_status", "date": "2025-01-23T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2020-35678", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1911314" } ], "notes": [ { "category": "description", "text": "A flaw was found in python-autobahn, where it allows redirect header injection. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "python-autobahn: allows redirect header injection", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-autobahn package.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-35678" }, { "category": "external", "summary": "RHBZ#1911314", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1911314" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-35678", "url": "https://www.cve.org/CVERecord?id=CVE-2020-35678" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-35678", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-35678" } ], "release_date": "2020-12-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-03-09T15:50:37+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0778" }, { "category": "workaround", "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "python-autobahn: allows redirect header injection" }, { "acknowledgments": [ { "names": [ "Matei Mal Badanoiu" ], "organization": "Deloitte Romania" } ], "cve": "CVE-2021-20253", "cwe": { "id": "CWE-552", "name": "Files or Directories Accessible to External Parties" }, "discovery_date": "2021-02-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1928847" } ], "notes": [ { "category": "description", "text": "A flaw was found in ansible-tower. The default installation is vulnerable to Job Isolation escape allowing an attacker to elevate the privilege from a low privileged user to the awx user from outside the isolated environment. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "ansible-tower: Privilege escalation via job isolation escape", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-20253" }, { "category": "external", "summary": "RHBZ#1928847", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1928847" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-20253", "url": "https://www.cve.org/CVERecord?id=CVE-2021-20253" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-20253", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-20253" } ], "release_date": "2021-03-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2021-03-09T15:50:37+00:00", "details": "For information on upgrading Ansible Tower, reference the Ansible Tower Upgrade and Migration Guide: https://docs.ansible.com/ansible-tower/latest/html/upgrade-migration-guide/index.html", "product_ids": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2021:0778" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update as soon as possible.", "product_ids": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 6.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-Ansible-Tower-3.6:ansible-tower-36/ansible-tower@sha256:b693ff9d898bc14a776b881bc8c868a7c3472456d6f009bb81d4dd5f85835e28_amd64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "ansible-tower: Privilege escalation via job isolation escape" } ] }
rhsa-2023_0552
Vulnerability from csaf_redhat
Published
2023-01-31 13:15
Modified
2024-12-16 02:20
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
Notes
Topic
An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* bootstrap: XSS in the data-target attribute (CVE-2016-10735)
* bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)
* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)
* nodejs-moment: Regular expression denial of service (CVE-2017-18214)
* wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n\n* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)\n\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n\n* jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods (CVE-2020-11023)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* bootstrap: XSS in the data-target attribute (CVE-2016-10735)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)\n\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n\n* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n\n* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)\n\n* nodejs-moment: Regular expression denial of service (CVE-2017-18214)\n\n* wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)\n\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0552", "url": "https://access.redhat.com/errata/RHSA-2023:0552" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/" }, { "category": "external", "summary": "1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "1553413", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553413" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601616" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "2124682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124682" }, { "category": "external", "summary": "2134291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134291" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "JBEAP-23864", "url": "https://issues.redhat.com/browse/JBEAP-23864" }, { "category": "external", "summary": "JBEAP-23865", "url": "https://issues.redhat.com/browse/JBEAP-23865" }, { "category": "external", "summary": "JBEAP-23866", "url": "https://issues.redhat.com/browse/JBEAP-23866" }, { "category": "external", "summary": "JBEAP-23926", "url": "https://issues.redhat.com/browse/JBEAP-23926" }, { "category": "external", "summary": "JBEAP-24055", "url": "https://issues.redhat.com/browse/JBEAP-24055" }, { "category": "external", "summary": "JBEAP-24081", "url": "https://issues.redhat.com/browse/JBEAP-24081" }, { "category": "external", "summary": "JBEAP-24095", "url": "https://issues.redhat.com/browse/JBEAP-24095" }, { "category": "external", "summary": "JBEAP-24100", "url": "https://issues.redhat.com/browse/JBEAP-24100" }, { "category": "external", "summary": "JBEAP-24127", "url": "https://issues.redhat.com/browse/JBEAP-24127" }, { "category": "external", "summary": "JBEAP-24128", "url": "https://issues.redhat.com/browse/JBEAP-24128" }, { "category": "external", "summary": "JBEAP-24132", "url": "https://issues.redhat.com/browse/JBEAP-24132" }, { "category": "external", "summary": "JBEAP-24147", "url": "https://issues.redhat.com/browse/JBEAP-24147" }, { "category": "external", "summary": "JBEAP-24167", "url": "https://issues.redhat.com/browse/JBEAP-24167" }, { "category": "external", "summary": "JBEAP-24191", "url": "https://issues.redhat.com/browse/JBEAP-24191" }, { "category": "external", "summary": "JBEAP-24195", "url": "https://issues.redhat.com/browse/JBEAP-24195" }, { "category": "external", "summary": "JBEAP-24207", "url": "https://issues.redhat.com/browse/JBEAP-24207" }, { "category": "external", "summary": "JBEAP-24248", "url": "https://issues.redhat.com/browse/JBEAP-24248" }, { "category": "external", "summary": "JBEAP-24426", "url": "https://issues.redhat.com/browse/JBEAP-24426" }, { "category": "external", "summary": "JBEAP-24427", "url": "https://issues.redhat.com/browse/JBEAP-24427" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0552.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update", "tracking": { "current_release_date": "2024-12-16T02:20:15+00:00", "generator": { "date": "2024-12-16T02:20:15+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2023:0552", "initial_release_date": "2023-01-31T13:15:22+00:00", "revision_history": [ { "date": "2023-01-31T13:15:22+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-01-31T13:15:22+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-16T02:20:15+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product": { "name": "Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform" }, { "branches": [ { "category": "product_version", "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src", "product": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src", "product_id": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-woodstox-core@6.4.0-1.redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-java8@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-elytron-web@1.9.3-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-databind@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "product": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "product_id": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-javaee-security-soteria@1.0.1-3.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-providers@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-annotations@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "product": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "product_id": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jettison@1.5.2-1.redhat_00002.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-core@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-base@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "product": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "product_id": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.22-1.SP3_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-remoting@5.0.27-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.16-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.10-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsp-api_2.3_spec@2.0.0-3.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "product": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "product_id": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-sshd@2.9.2-1.redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-ejb-client@4.0.49-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsf-api_2.3_spec@3.0.0-6.SP07_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search@5.10.13-3.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.16-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "product_id": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-24.Final_redhat_00023.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "product": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "product_id": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.9-4.GA_redhat_00003.1.el7eap?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "product_id": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-woodstox-core@6.4.0-1.redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-datatype-jdk8@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-datatype-jsr310@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-java8@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow-server@1.9.3-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-databind@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product_id": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-javaee-security-soteria@1.0.1-3.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product_id": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-javaee-security-soteria-enterprise@1.0.1-3.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-base@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-json-provider@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-annotations@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "product": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "product_id": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jettison@1.5.2-1.redhat_00002.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-core@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-module-jaxb-annotations@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-base@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "product_id": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.22-1.SP3_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-remoting@5.0.27-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.16-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-api@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-impl@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-spi@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-api@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-impl@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-deployers-common@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-jdbc@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-validator@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsp-api_2.3_spec@2.0.0-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "product_id": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-sshd@2.9.2-1.redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-ejb-client@4.0.49-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsf-api_2.3_spec@3.0.0-6.SP07_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-backend-jgroups@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-backend-jms@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-engine@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-orm@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-serialization-avro@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.16-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron-tool@1.15.16-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_id": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-24.Final_redhat_00023.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_id": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-cli@1.10.0-24.Final_redhat_00023.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product": { "name": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_id": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-core@1.10.0-24.Final_redhat_00023.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_id": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.9-4.GA_redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_id": "eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.4.9-4.GA_redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_id": "eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.4.9-4.GA_redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_id": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.4.9-4.GA_redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_id": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.4.9-4.GA_redhat_00003.1.el7eap?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src" }, "product_reference": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch" }, "product_reference": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch" }, "product_reference": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch" }, "product_reference": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" }, "product_reference": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src" }, "product_reference": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" }, "product_reference": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-9251", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2016-11-27T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1399546" } ], "notes": [ { "category": "description", "text": "jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting via cross-domain ajax requests", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-9251" }, { "category": "external", "summary": "RHBZ#1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-9251", "url": "https://www.cve.org/CVERecord?id=CVE-2015-9251" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-9251", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9251" } ], "release_date": "2015-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Cross-site scripting via cross-domain ajax requests" }, { "cve": "CVE-2016-10735", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-01-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668097" } ], "notes": [ { "category": "description", "text": "In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the data-target attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.\n\nRed Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-10735" }, { "category": "external", "summary": "RHBZ#1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-10735", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735" } ], "release_date": "2016-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: XSS in the data-target attribute" }, { "cve": "CVE-2017-18214", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-03-08T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1553413" } ], "notes": [ { "category": "description", "text": "The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-moment: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of momentjs as shipped with Red Hat Enterprise Satellite 5. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-18214" }, { "category": "external", "summary": "RHBZ#1553413", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553413" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-18214", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18214" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-18214", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18214" } ], "release_date": "2017-09-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-moment: Regular expression denial of service" }, { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14041", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601616" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the data-target property of scrollspy. This flaw allows a remote attacker to execute a script in a victim\u0027s Web browser within the security context of the hosting Web site, which can lead to stealing the victim\u0027s cookie-based authentication credentials.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14041" }, { "category": "external", "summary": "RHBZ#1601616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601616" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14041", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14041" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14041", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14041" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-8331", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-02-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1686454" } ], "notes": [ { "category": "description", "text": "A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the tooltip or popover data-template attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-8331" }, { "category": "external", "summary": "RHBZ#1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-8331", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8331" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331" } ], "release_date": "2019-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: XSS in the tooltip or popover data-template attribute" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. However, the vulnerability has not been found to be exploitable in reasonable scenarios. \n\nIn RHEL7, pcs-0.9.169-3.el7_9.3 [RHSA-2022:7343] contains an updated version of jquery (3.6.0), which does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2022-3143", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-09-06T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2124682" } ], "notes": [ { "category": "description", "text": "A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.", "title": "Vulnerability description" }, { "category": "summary", "text": "wildfly-elytron: possible timing attacks via use of unsafe comparator", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3143" }, { "category": "external", "summary": "RHBZ#2124682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3143", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3143" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3143", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3143" } ], "release_date": "2022-09-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "wildfly-elytron: possible timing attacks via use of unsafe comparator" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-40152", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134291" } ], "notes": [ { "category": "description", "text": "A flaw was found in the FasterXML/woodstox package. This flaw allows an attacker to cause a denial of service (DoS) in its target via XML serialization. An attacker may benefit from the parser sending a malicious input that may cause a crash. This vulnerability is only relevant for users using the DTD parsing functionality.", "title": "Vulnerability description" }, { "category": "summary", "text": "woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40152" }, { "category": "external", "summary": "RHBZ#2134291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134291" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40152", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40152" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40152", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40152" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-3f7h-mf4q-vrm4", "url": "https://github.com/advisories/GHSA-3f7h-mf4q-vrm4" } ], "release_date": "2022-09-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "CXF: SSRF Vulnerability" } ] }
RHSA-2023:1045
Vulnerability from csaf_redhat
Published
2023-03-01 21:45
Modified
2025-07-16 19:52
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9
Notes
Topic
New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.2 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* keycloak: missing email notification template allowlist (CVE-2022-1274)
* keycloak: minimist: prototype pollution (CVE-2021-44906)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)
* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
* keycloak: path traversal via double URL encoding (CVE-2022-3782)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
* keycloak: reflected XSS attack (CVE-2022-4137)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.2 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n* keycloak: missing email notification template allowlist (CVE-2022-1274)\n* keycloak: minimist: prototype pollution (CVE-2021-44906)\n* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)\n* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)\n* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)\n* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)\n* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)\n* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n* jquery: Passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n* keycloak: reflected XSS attack (CVE-2022-4137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1045", "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1045.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9", "tracking": { "current_release_date": "2025-07-16T19:52:28+00:00", "generator": { "date": "2025-07-16T19:52:28+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2023:1045", "initial_release_date": "2023-03-01T21:45:17+00:00", "revision_history": [ { "date": "2023-03-01T21:45:17+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-01T21:45:17+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-16T19:52:28+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.6 for RHEL 9", "product": { "name": "Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el9sso?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el9sso?arch=noarch" } } }, { "category": "product_version", "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_id": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak-server@18.0.6-1.redhat_00001.1.el9sso?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "relates_to_product_reference": "9Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "relates_to_product_reference": "9Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" }, "product_reference": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "relates_to_product_reference": "9Base-RHSSO-7.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis controls ensure that security flaws, including XSS vulnerabilities, are detected early in development by scanning code for improper input handling. This prevents vulnerable code from reaching production and encourages our developers to follow secure coding practices. System monitoring controls play a crucial role in detecting and responding to XSS attacks by analyzing logs, monitoring user behavior, and generating alerts for suspicious activity. Meanwhile, AWS WAF (Web Application Firewall) adds an extra layer of defense by filtering and blocking malicious input before it reaches the platform and/or application. Together, these controls create a defense-in-depth approach, reducing the risk of XSS exploitation by preventing, detecting, and mitigating attacks at multiple levels.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "exploit_status", "date": "2025-01-23T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw (CVE-2021-44906) allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "As minimist is an argument parsing module for nodejs, exploitation of this vulnerability requires an attacker to influence which arguments are passed to nodejs when running a script. Red Hat products and services are designed in such a way that gaining this ability is not trivial. Additionally, the impact is limited by only enabling the pollution of functions, and not all generic objects.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "acknowledgments": [ { "names": [ "Marcus Nilsson" ], "organization": "usd AG" } ], "cve": "CVE-2022-1274", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073157" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: HTML injection in execute-actions-email Admin REST API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1274" }, { "category": "external", "summary": "RHBZ#2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1274" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725" } ], "release_date": "2023-02-28T18:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: HTML injection in execute-actions-email Admin REST API" }, { "acknowledgments": [ { "names": [ "Grzegorz Tworek" ], "organization": "SISOFT s.c." } ], "cve": "CVE-2022-1438", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2021-12-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2031904" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS on impersonation under specific circumstances", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1438" }, { "category": "external", "summary": "RHBZ#2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1438", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1438" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438" } ], "release_date": "2023-02-28T18:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS on impersonation under specific circumstances" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-2764", "discovery_date": "2022-08-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2117506" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK from the bytes, causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2764" }, { "category": "external", "summary": "RHBZ#2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2764", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2764" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764" } ], "release_date": "2022-08-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations" }, { "acknowledgments": [ { "names": [ "Peter Flintholm" ], "organization": "Trifork" } ], "cve": "CVE-2022-3916", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2022-11-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2141404" } ], "notes": [ { "category": "description", "text": "A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Session takeover with OIDC offline refreshtokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3916" }, { "category": "external", "summary": "RHBZ#2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3916" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916" } ], "release_date": "2022-11-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: Session takeover with OIDC offline refreshtokens" }, { "cve": "CVE-2022-4137", "cwe": { "id": "CWE-81", "name": "Improper Neutralization of Script in an Error Message Web Page" }, "discovery_date": "2022-11-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2148496" } ], "notes": [ { "category": "description", "text": "A reflected cross-site scripting (XSS) vulnerability was found in the \u0027oob\u0027 OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: reflected XSS attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4137" }, { "category": "external", "summary": "RHBZ#2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4137", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4137" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137" } ], "release_date": "2023-03-01T13:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: reflected XSS attack" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "other", "text": "In Quay 3.10 and above, no version of affected momentjs is present.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-31129", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-07-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2105075" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service (ReDoS) attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "moment: inefficient parsing algorithm resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse provides the affected software but does not use the functionality and as such its impact has been downgraded to Low.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships a vulnerable version of the moment library. However, this affected functionality is restricted behind OAuth, reducing the impact to Moderate.\n\nRed Hat Satellite ships a vulnerable version of the moment library. However, this only affects a specific component (qpid-dispatch), reducing the impact to Moderate.\n\nRed Hat Ceph Storage (RHCS) ships a vulnerable version of the moment library, however, it is not directly used and is a transitive dependency from Angular. In addition, the impact would only be to the grafana browser, and not the underlying RHCS system, which reduces the impact to Moderate. \n\nRed Hat OpenShift Service Mesh (OSSM) ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nRed Hat OpenShift distributed tracing ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nIn Logging Subsystem for Red Hat OpenShift the vulnerable moment nodejs package is bundled in the ose-logging-kibana6 container as a transitive dependency, hence the direct impact is reduced to Moderate.\n\nIn OpenShift Container Platform 4 the vulnerabile moment package is a third party dependency, hence the direct impact is reduced to Moderate.\n\nIn Quay IO 3.10 and above, no version of affected momentjs is present.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31129" }, { "category": "external", "summary": "RHBZ#2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31129", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g", "url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g" } ], "release_date": "2022-07-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "moment: inefficient parsing algorithm resulting in DoS" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-38749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129706" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38749" }, { "category": "external", "summary": "RHBZ#2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38749", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode" }, { "cve": "CVE-2022-38750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129707" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38750" }, { "category": "external", "summary": "RHBZ#2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38750", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject" }, { "cve": "CVE-2022-38751", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129709" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38751" }, { "category": "external", "summary": "RHBZ#2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "CXF: SSRF Vulnerability" }, { "acknowledgments": [ { "names": [ "Sourav Kumar" ], "organization": "https://github.com/souravs17031999", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0091", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Client Registration endpoint does not check token revocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0091" }, { "category": "external", "summary": "RHBZ#2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0091", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0091" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg" }, { "category": "external", "summary": "https://github.com/keycloak/security/issues/27", "url": "https://github.com/keycloak/security/issues/27" } ], "release_date": "2022-10-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: Client Registration endpoint does not check token revocation" }, { "acknowledgments": [ { "names": [ "Jordi Zayuelas i Mu\u00f1oz" ], "organization": "A1 Digital", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0264", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2023-01-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2160585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: user impersonation via stolen uuid code", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0264" }, { "category": "external", "summary": "RHBZ#2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0264", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0264" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264" } ], "release_date": "2023-02-28T18:58:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: user impersonation via stolen uuid code" } ] }
rhsa-2020:2362
Vulnerability from csaf_redhat
Published
2020-06-02 15:34
Modified
2025-06-26 06:36
Summary
Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update
Notes
Topic
An update for jaeger, kiali, and servicemesh-grafana is now available for OpenShift Service Mesh 1.0.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Service Mesh is Red Hat's distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.
Security Fix(es):
* nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties (CVE-2019-10744)
* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for jaeger, kiali, and servicemesh-grafana is now available for OpenShift Service Mesh 1.0.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Service Mesh is Red Hat\u0027s distribution of the Istio service mesh project, tailored for installation into an on-premise OpenShift Container Platform installation.\n\nSecurity Fix(es):\n\n* nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties (CVE-2019-10744)\n\n* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* grafana: information disclosure through world-readable grafana configuration files (CVE-2020-12459)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2362", "url": "https://access.redhat.com/errata/RHSA-2020:2362" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1739497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1739497" }, { "category": "external", "summary": "1813344", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813344" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1829724", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1829724" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2362.json" } ], "title": "Red Hat Security Advisory: Red Hat OpenShift Service Mesh security update", "tracking": { "current_release_date": "2025-06-26T06:36:12+00:00", "generator": { "date": "2025-06-26T06:36:12+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2020:2362", "initial_release_date": "2020-06-02T15:34:01+00:00", "revision_history": [ { "date": "2020-06-02T15:34:01+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-06-02T15:34:01+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-06-26T06:36:12+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Service Mesh 1.0", "product": { "name": "Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.0::el7" } } }, { "category": "product_name", "name": "OpenShift Service Mesh 1.0", "product": { "name": "OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0", "product_identification_helper": { "cpe": "cpe:/a:redhat:service_mesh:1.0::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Service Mesh" }, { "branches": [ { "category": "product_version", "name": "jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "product": { "name": "jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "product_id": "jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jaeger@v1.13.1.redhat7-1.el7?arch=x86_64" } } }, { "category": "product_version", "name": "kiali-0:v1.0.11.redhat1-1.el7.x86_64", "product": { "name": "kiali-0:v1.0.11.redhat1-1.el7.x86_64", "product_id": "kiali-0:v1.0.11.redhat1-1.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/kiali@v1.0.11.redhat1-1.el7?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-grafana-0:6.2.2-36.el8.x86_64", "product": { "name": "servicemesh-grafana-0:6.2.2-36.el8.x86_64", "product_id": "servicemesh-grafana-0:6.2.2-36.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.2.2-36.el8?arch=x86_64" } } }, { "category": "product_version", "name": "servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64", "product": { "name": "servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64", "product_id": "servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana-prometheus@6.2.2-36.el8?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "jaeger-0:v1.13.1.redhat7-1.el7.src", "product": { "name": "jaeger-0:v1.13.1.redhat7-1.el7.src", "product_id": "jaeger-0:v1.13.1.redhat7-1.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jaeger@v1.13.1.redhat7-1.el7?arch=src" } } }, { "category": "product_version", "name": "kiali-0:v1.0.11.redhat1-1.el7.src", "product": { "name": "kiali-0:v1.0.11.redhat1-1.el7.src", "product_id": "kiali-0:v1.0.11.redhat1-1.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/kiali@v1.0.11.redhat1-1.el7?arch=src" } } }, { "category": "product_version", "name": "servicemesh-grafana-0:6.2.2-36.el8.src", "product": { "name": "servicemesh-grafana-0:6.2.2-36.el8.src", "product_id": "servicemesh-grafana-0:6.2.2-36.el8.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/servicemesh-grafana@6.2.2-36.el8?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "jaeger-0:v1.13.1.redhat7-1.el7.src as a component of Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src" }, "product_reference": "jaeger-0:v1.13.1.redhat7-1.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "jaeger-0:v1.13.1.redhat7-1.el7.x86_64 as a component of Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64" }, "product_reference": "jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "kiali-0:v1.0.11.redhat1-1.el7.src as a component of Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src" }, "product_reference": "kiali-0:v1.0.11.redhat1-1.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "kiali-0:v1.0.11.redhat1-1.el7.x86_64 as a component of Red Hat OpenShift Service Mesh 1.0", "product_id": "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64" }, "product_reference": "kiali-0:v1.0.11.redhat1-1.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.2.2-36.el8.src as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src" }, "product_reference": "servicemesh-grafana-0:6.2.2-36.el8.src", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-0:6.2.2-36.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64" }, "product_reference": "servicemesh-grafana-0:6.2.2-36.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" }, { "category": "default_component_of", "full_product_name": { "name": "servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64 as a component of OpenShift Service Mesh 1.0", "product_id": "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" }, "product_reference": "servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64", "relates_to_product_reference": "8Base-OSSM-1.0" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-10744", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-07-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1739497" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in lodash. Calling certain methods with untrusted JSON could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "title": "Vulnerability summary" }, { "category": "other", "text": "The lodash dependency is included in OpenShift Container Platform (OCP) by Kibana in the aggregated logging stack. Elastic have issued a security advisory (ESA-2019-10) for Kibana for this vulnerability, and in that advisory stated that no exploit vectors had been identified in Kibana. Therefore we rate this issue as moderate for OCP and may fix this issue in a future release.\n\nhttps://www.elastic.co/community/security\n\nThis issue did not affect the versions of rh-nodejs8-nodejs and rh-nodejs10-nodejs as shipped with Red Hat Software Collections.\n\nWhilst a vulnerable version of lodash has been included in ServiceMesh, the impact is lowered to Moderate due to the library not being directly accessible increasing the attack complexity and the fact that the attacker would need some existing access - meaning the vulnerability is not crossing a privilege boundary.\n\nRed Hat Quay imports lodash as a runtime dependency of restangular. The restangular function in use by Red Hat Quay do not use lodash to parse user input. This issue therefore rated moderate impact for Red Hat Quay.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10744" }, { "category": "external", "summary": "RHBZ#1739497", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1739497" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10744", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10744" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10744", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10744" } ], "release_date": "2019-08-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-02T15:34:01+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2362" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H", "version": "3.0" }, "products": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties" }, { "cve": "CVE-2020-7598", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-03-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1813344" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-minimist, where it was tricked into adding or modifying properties of the Object.prototype using a \"constructor\" or \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay only includes minimist as a dependency of the test suites, and it not include it in the product. We may fix this issue in a future Red Hat Quay release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7598" }, { "category": "external", "summary": "RHBZ#1813344", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813344" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7598", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7598" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764", "url": "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764" } ], "release_date": "2020-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-02T15:34:01+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2362" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-02T15:34:01+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2362" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-12459", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1829724" } ], "notes": [ { "category": "description", "text": "An information-disclosure flaw was found in Grafana distributed by Red Hat. This flaw allows a local attacker access to potentially sensitive information such as secret_key and a bind_password from the world-readable files /etc/grafana/grafana.ini and /etc/grafana/ldap.toml.", "title": "Vulnerability description" }, { "category": "summary", "text": "grafana: information disclosure through world-readable grafana configuration files", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Ceph Storage 3 and 4 are not affected by this vulnerability, as the shared grafana container uses grafana v5.2.4 which sets correct permissions for configuration files.\n\nThis issue did not affect the version of grafana as shipped with Red Hat Gluster Storage 3, as it ships grafana v4.6.4 which sets correct permissions for configuration files.\n\nIn both OpenShift Container Platform (OCP) and OpenShift ServiceMesh (OSSM), the grafana containers set their database files to world readable. However, as it\u0027s run in a container image with SELinux MCS labels this prevents other processes on the host from reading it. Therefore, for both (OCP and OSSM) the impact is low.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-12459" }, { "category": "external", "summary": "RHBZ#1829724", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1829724" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-12459", "url": "https://www.cve.org/CVERecord?id=CVE-2020-12459" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-12459", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-12459" } ], "release_date": "2020-04-23T20:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-06-02T15:34:01+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2362" }, { "category": "workaround", "details": "Manually change the files permission to remove readable bits for others:\n\n# chmod 640 /etc/grafana/grafana.ini /etc/grafana/ldap.toml", "product_ids": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 6.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.src", "7Server-RH7-RHOSSM-1.0:jaeger-0:v1.13.1.redhat7-1.el7.x86_64", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.src", "7Server-RH7-RHOSSM-1.0:kiali-0:v1.0.11.redhat1-1.el7.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.src", "8Base-OSSM-1.0:servicemesh-grafana-0:6.2.2-36.el8.x86_64", "8Base-OSSM-1.0:servicemesh-grafana-prometheus-0:6.2.2-36.el8.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "grafana: information disclosure through world-readable grafana configuration files" } ] }
rhsa-2020:2412
Vulnerability from csaf_redhat
Published
2020-07-13 17:22
Modified
2025-07-10 20:16
Summary
Red Hat Security Advisory: OpenShift Container Platform 4.5 container image security update
Notes
Topic
An update is now available for Red Hat OpenShift Container Platform 4.5.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allowed for panic (CVE-2020-9283)
* kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254)
* js-jquery: prototype pollution in object's prototype led to denial of service or remote code execution or property injection (CVE-2019-11358)
* kubernetes: node localhost services reachable via martian packets (CVE-2020-8558)
* containernetworking/plugins: IPv6 router advertisements allowed for MitM attacks on IPv4 clusters (CVE-2020-10749)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat OpenShift Container Platform 4.5.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allowed for panic (CVE-2020-9283)\n\n* kubernetes: Denial of service in API server via crafted YAML payloads by authorized users (CVE-2019-11254)\n\n* js-jquery: prototype pollution in object\u0027s prototype led to denial of service or remote code execution or property injection (CVE-2019-11358)\n\n* kubernetes: node localhost services reachable via martian packets (CVE-2020-8558)\n\n* containernetworking/plugins: IPv6 router advertisements allowed for MitM attacks on IPv4 clusters (CVE-2020-10749)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2412", "url": "https://access.redhat.com/errata/RHSA-2020:2412" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1804533", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1804533" }, { "category": "external", "summary": "1819486", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819486" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1833220", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1833220" }, { "category": "external", "summary": "1843358", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843358" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2412.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 4.5 container image security update", "tracking": { "current_release_date": "2025-07-10T20:16:31+00:00", "generator": { "date": "2025-07-10T20:16:31+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2020:2412", "initial_release_date": "2020-07-13T17:22:28+00:00", "revision_history": [ { "date": "2020-07-13T17:22:28+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-13T17:22:28+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-10T20:16:31+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 4.5", "product": { "name": "Red Hat OpenShift Container Platform 4.5", "product_id": "7Server-RH7-RHOSE-4.5", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:4.5::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "product": { "name": "openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "product_id": "openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "product_identification_helper": { "purl": "pkg:oci/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-cluster-logging-operator\u0026tag=v4.5.0-202007012112.p0" } } }, { "category": "product_version", "name": "openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "product": { "name": "openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "product_id": "openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "product_identification_helper": { "purl": "pkg:oci/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-multus-cni\u0026tag=v4.5.0-202007012112.p0" } } }, { "category": "product_version", "name": "openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64", "product": { "name": "openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64", "product_id": "openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64", "product_identification_helper": { "purl": "pkg:oci/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-oauth-server-rhel7\u0026tag=v4.5.0-202007012112.p0" } } }, { "category": "product_version", "name": "openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "product": { "name": "openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "product_id": "openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "product_identification_helper": { "purl": "pkg:oci/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-cluster-capacity\u0026tag=v4.5.0-202007012112.p0" } } }, { "category": "product_version", "name": "openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "product": { "name": "openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "product_id": "openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "product_identification_helper": { "purl": "pkg:oci/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-console\u0026tag=v4.5.0-202007012112.p0" } } }, { "category": "product_version", "name": "openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "product": { "name": "openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "product_id": "openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "product_identification_helper": { "purl": "pkg:oci/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-hyperkube\u0026tag=v4.5.0-202007100518.p0" } } }, { "category": "product_version", "name": "openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "product": { "name": "openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "product_id": "openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "product_identification_helper": { "purl": "pkg:oci/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d?arch=amd64\u0026repository_url=registry.redhat.io/openshift4/ose-cluster-machine-approver\u0026tag=v4.5.0-202007012112.p0" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64 as a component of Red Hat OpenShift Container Platform 4.5", "product_id": "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64" }, "product_reference": "openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64 as a component of Red Hat OpenShift Container Platform 4.5", "product_id": "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64" }, "product_reference": "openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64 as a component of Red Hat OpenShift Container Platform 4.5", "product_id": "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64" }, "product_reference": "openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64 as a component of Red Hat OpenShift Container Platform 4.5", "product_id": "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64" }, "product_reference": "openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64 as a component of Red Hat OpenShift Container Platform 4.5", "product_id": "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64" }, "product_reference": "openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64 as a component of Red Hat OpenShift Container Platform 4.5", "product_id": "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64" }, "product_reference": "openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.5" }, { "category": "default_component_of", "full_product_name": { "name": "openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64 as a component of Red Hat OpenShift Container Platform 4.5", "product_id": "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" }, "product_reference": "openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64", "relates_to_product_reference": "7Server-RH7-RHOSE-4.5" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-11252", "cwe": { "id": "CWE-209", "name": "Generation of Error Message Containing Sensitive Information" }, "discovery_date": "2020-07-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1860158" } ], "notes": [ { "category": "description", "text": "A flaw was found in Kubernetes that allows the logging of credentials when mounting AzureFile and CephFS volumes. This flaw allows an attacker to access kubelet logs, read the credentials, and use them to access other services. The highest threat from this vulnerability is to confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: credential leak in kube-controller-manager via error messages in mount failure logs and events for AzureFile and CephFS volumes", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform (OCP) included the upstream patch for this flaw in the release of version 4.5. Prior versions are affected as OCP 4 supports AzureFile volumes and OCP 3 supports both AzureFile and CephFS volumes. OCP clusters not using these volume types are not vulnerable.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11252" }, { "category": "external", "summary": "RHBZ#1860158", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1860158" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11252", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11252" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11252", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11252" } ], "release_date": "2020-03-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-13T17:22:28+00:00", "details": "For OpenShift Container Platform 4.5 see the following documentation, which\nwill be updated shortly for release 4.5.1, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2412" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: credential leak in kube-controller-manager via error messages in mount failure logs and events for AzureFile and CephFS volumes" }, { "cve": "CVE-2019-11254", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2020-04-01T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1819486" } ], "notes": [ { "category": "description", "text": "The Kubernetes API Server component in versions 1.1-1.14, and versions prior to 1.15.10, 1.16.7 and 1.17.3 allows an authorized user who sends malicious YAML payloads to cause the kube-apiserver to consume excessive CPU cycles while parsing YAML.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: Denial of service in API server via crafted YAML payloads by authorized users", "title": "Vulnerability summary" }, { "category": "other", "text": "The upstream Kubernetes fix for this vulnerability is to update the version of the Go dependency, gopkg.in/yaml.v2. This issue affects OpenShift Container Platform components that use versions before 2.2.8 of gopkg.in/yaml.v2 and accept YAML payloads.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11254" }, { "category": "external", "summary": "RHBZ#1819486", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819486" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11254", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11254" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11254", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11254" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/wuwEwZigXBc" } ], "release_date": "2020-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-13T17:22:28+00:00", "details": "For OpenShift Container Platform 4.5 see the following documentation, which\nwill be updated shortly for release 4.5.1, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2412" }, { "category": "workaround", "details": "Prevent unauthenticated or unauthorized access to the API server", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: Denial of service in API server via crafted YAML payloads by authorized users" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-13T17:22:28+00:00", "details": "For OpenShift Container Platform 4.5 see the following documentation, which\nwill be updated shortly for release 4.5.1, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2412" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "acknowledgments": [ { "names": [ "the Kubernetes Product Security Committee" ] }, { "names": [ "Yuval Avrahami", "Ariel Zelivansky" ], "organization": "Palo Alto Networks", "summary": "Acknowledged by upstream." }, { "names": [ "J\u00e1nos K\u00f6v\u00e9r" ], "organization": "Ericsson", "summary": "Acknowledged by upstream." }, { "names": [ "Rory McCune" ], "organization": "NCC Group", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-8558", "cwe": { "id": "CWE-300", "name": "Channel Accessible by Non-Endpoint" }, "discovery_date": "2020-05-29T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1843358" } ], "notes": [ { "category": "description", "text": "A flaw was found in Kubernetes that allows attackers on adjacent networks to reach services exposed on localhost ports, previously thought to be unreachable. This flaw allows an attacker to gain privileges or access confidential information for any services listening on localhost ports that are not protected by authentication.", "title": "Vulnerability description" }, { "category": "summary", "text": "kubernetes: node localhost services reachable via martian packets", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform does not expose the API server on a localhost port without authentication. The only service exposed on a localhost port not protected by authentication is Metrics, which exposes some cluster metadata.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8558" }, { "category": "external", "summary": "RHBZ#1843358", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843358" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8558", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8558" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8558", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8558" }, { "category": "external", "summary": "https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE", "url": "https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE" } ], "release_date": "2020-07-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-13T17:22:28+00:00", "details": "For OpenShift Container Platform 4.5 see the following documentation, which\nwill be updated shortly for release 4.5.1, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2412" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "kubernetes: node localhost services reachable via martian packets" }, { "cve": "CVE-2020-9283", "cwe": { "id": "CWE-130", "name": "Improper Handling of Length Parameter Inconsistency" }, "discovery_date": "2020-02-19T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1804533" } ], "notes": [ { "category": "description", "text": "A denial of service vulnerability was found in the SSH package of the golang.org/x/crypto library. An attacker could exploit this flaw by supplying crafted SSH ed25519 keys to cause a crash in applications that use this package as either an SSH client or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenShift Container Platform uses the vulnerable library in a number of components but strictly as an SSH client. The severity of this vulnerability is reduced for clients as it requires connections to malicious SSH servers, with the maximum impact only a client crash. This vulnerability is rated Low for OpenShift Container Platform.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-9283" }, { "category": "external", "summary": "RHBZ#1804533", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1804533" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9283", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9283" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9283", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9283" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY", "url": "https://groups.google.com/forum/#!topic/golang-announce/3L45YRc91SY" } ], "release_date": "2020-02-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-13T17:22:28+00:00", "details": "For OpenShift Container Platform 4.5 see the following documentation, which\nwill be updated shortly for release 4.5.1, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2412" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "golang.org/x/crypto: Processing of crafted ssh-ed25519 public keys allows for panic" }, { "acknowledgments": [ { "names": [ "the Kubernetes Product Security Committee" ] }, { "names": [ "Etienne Champetier" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2020-10749", "cwe": { "id": "CWE-300", "name": "Channel Accessible by Non-Endpoint" }, "discovery_date": "2020-05-08T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1833220" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in affected container networking implementations that allow malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending \u201crogue\u201d IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.", "title": "Vulnerability description" }, { "category": "summary", "text": "containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Container Platform 4, the default network plugin, OpenShift SDN, and OVN Kubernetes, do not forward IPv6 traffic, making this vulnerability not exploitable. The affected code from containernetworking/plugins is however still included in these plugins, hence this vulnerability is rated Low for both OpenShift SDN and OVN-Kubernetes.\n\nIPv6 traffic is not forwarded by the OpenShift SDN in OpenShift Container Platform 3.11, making this vulnerability not exploitable. However, the affected code from containernetworking/plugins is still included in the atomic-openshift package, hence this vulnerability is rated Low for OpenShift Container Platform 3.11.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10749" }, { "category": "external", "summary": "RHBZ#1833220", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1833220" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10749", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10749" }, { "category": "external", "summary": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8", "url": "https://groups.google.com/forum/#!topic/kubernetes-security-announce/BMb_6ICCfp8" } ], "release_date": "2020-06-01T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-13T17:22:28+00:00", "details": "For OpenShift Container Platform 4.5 see the following documentation, which\nwill be updated shortly for release 4.5.1, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2412" }, { "category": "workaround", "details": "Prevent untrusted, non-privileged containers from running with CAP_NET_RAW.", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "containernetworking/plugins: IPv6 router advertisements allow for MitM attacks on IPv4 clusters" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-13T17:22:28+00:00", "details": "For OpenShift Container Platform 4.5 see the following documentation, which\nwill be updated shortly for release 4.5.1, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2412" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis controls ensure that security flaws, including XSS vulnerabilities, are detected early in development by scanning code for improper input handling. This prevents vulnerable code from reaching production and encourages our developers to follow secure coding practices. System monitoring controls play a crucial role in detecting and responding to XSS attacks by analyzing logs, monitoring user behavior, and generating alerts for suspicious activity. Meanwhile, AWS WAF (Web Application Firewall) adds an extra layer of defense by filtering and blocking malicious input before it reaches the platform and/or application. Together, these controls create a defense-in-depth approach, reducing the risk of XSS exploitation by preventing, detecting, and mitigating attacks at multiple levels.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64" ], "known_not_affected": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-13T17:22:28+00:00", "details": "For OpenShift Container Platform 4.5 see the following documentation, which\nwill be updated shortly for release 4.5.1, for important instructions on\nhow to upgrade your cluster and fully apply this asynchronous errata\nupdate:\n\nhttps://docs.openshift.com/container-platform/4.5/release_notes/ocp-4-5-release-notes.html\n\nDetails on how to access this content are available at\nhttps://docs.openshift.com/container-platform/4.5/updating/updating-cluster-cli.html.", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2412" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.", "product_ids": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-capacity@sha256:d5e08d20c26a06ba87da356e9d2214b3c2a9b0f95b7e38028afbd8bb48b1ca92_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-logging-operator@sha256:ba8d0825e4a292d16eae81a02bc24bb069ed547e9d1910449746cf0a643d2fe2_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-cluster-machine-approver@sha256:42c4d1b8d4597b6d36f0d38579484bfeae16bbbdcf08801405ee19e6758a361d_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-console@sha256:9b3eae3982cbfe287635f85a3eecf9aabdb233d3e6c8df725190e214d4521034_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-hyperkube@sha256:4e2b3627fe571bc63d57290cf96b914d45ebe2e0efe0b14bd3530fd34e7b288c_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-multus-cni@sha256:2a2674e5f2422cb2f1c61299cbd5a72576161d12707f86b5131e46c13d5f33e3_amd64", "7Server-RH7-RHOSE-4.5:openshift4/ose-oauth-server-rhel7@sha256:143209653c725c16da6312e1cc7cc1a8c6ac634aee1eb6d5d52c31244cadc6df_amd64" ] } ], "threats": [ { "category": "exploit_status", "date": "2025-01-23T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" } ] }
rhsa-2020_2217
Vulnerability from csaf_redhat
Published
2020-05-28 14:58
Modified
2024-11-13 22:12
Summary
Red Hat Security Advisory: OpenShift Container Platform 3.11 security update
Notes
Topic
Red Hat OpenShift Container Platform release 3.11.219 is now available with
updates to packages and images that fix several bugs and add enhancements.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* jquery: Cross-site scripting was present due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenShift Container Platform release 3.11.219 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* jquery: Cross-site scripting was present due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s)\nlisted in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2217", "url": "https://access.redhat.com/errata/RHSA-2020:2217" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2217.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 3.11 security update", "tracking": { "current_release_date": "2024-11-13T22:12:42+00:00", "generator": { "date": "2024-11-13T22:12:42+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.0" } }, "id": "RHSA-2020:2217", "initial_release_date": "2020-05-28T14:58:14+00:00", "revision_history": [ { "date": "2020-05-28T14:58:14+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-05-28T14:58:14+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-13T22:12:42+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 3.11", "product": { "name": "Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.11::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "product": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "product_id": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-web-console@3.11.219-1.git.1.9b9b889.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64", "product": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64", "product_id": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-web-console@3.11.219-1.git.1.9b9b889.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "product": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "product_id": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-web-console@3.11.219-1.git.1.9b9b889.el7?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le" }, "product_reference": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src" }, "product_reference": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64" }, "product_reference": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-05-28T14:58:14+00:00", "details": "Before applying this update, ensure all previously released errata relevant\nto your system is applied.\n\nSee the following documentation, which will be updated shortly for release\n3.11.219, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.", "product_ids": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2217" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" } ] }
rhsa-2023:1043
Vulnerability from csaf_redhat
Published
2023-03-01 22:02
Modified
2025-07-16 19:52
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7
Notes
Topic
New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.2 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* keycloak: missing email notification template allowlist (CVE-2022-1274)
* keycloak: minimist: prototype pollution (CVE-2021-44906)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)
* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
* keycloak: path traversal via double URL encoding (CVE-2022-3782)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
* keycloak: reflected XSS attack (CVE-2022-4137)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.2 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n* keycloak: missing email notification template allowlist (CVE-2022-1274)\n* keycloak: minimist: prototype pollution (CVE-2021-44906)\n* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)\n* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)\n* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)\n* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)\n* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)\n* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n* jquery: Passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n* keycloak: reflected XSS attack (CVE-2022-4137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1043", "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1043.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7", "tracking": { "current_release_date": "2025-07-16T19:52:53+00:00", "generator": { "date": "2025-07-16T19:52:53+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2023:1043", "initial_release_date": "2023-03-01T22:02:40+00:00", "revision_history": [ { "date": "2023-03-01T22:02:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-01T22:02:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-16T19:52:53+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product": { "name": "Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el7sso?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el7sso?arch=noarch" } } }, { "category": "product_version", "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_id": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak-server@18.0.6-1.redhat_00001.1.el7sso?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "relates_to_product_reference": "7Server-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "relates_to_product_reference": "7Server-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" }, "product_reference": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "relates_to_product_reference": "7Server-RHSSO-7.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis controls ensure that security flaws, including XSS vulnerabilities, are detected early in development by scanning code for improper input handling. This prevents vulnerable code from reaching production and encourages our developers to follow secure coding practices. System monitoring controls play a crucial role in detecting and responding to XSS attacks by analyzing logs, monitoring user behavior, and generating alerts for suspicious activity. Meanwhile, AWS WAF (Web Application Firewall) adds an extra layer of defense by filtering and blocking malicious input before it reaches the platform and/or application. Together, these controls create a defense-in-depth approach, reducing the risk of XSS exploitation by preventing, detecting, and mitigating attacks at multiple levels.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "exploit_status", "date": "2025-01-23T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw (CVE-2021-44906) allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "As minimist is an argument parsing module for nodejs, exploitation of this vulnerability requires an attacker to influence which arguments are passed to nodejs when running a script. Red Hat products and services are designed in such a way that gaining this ability is not trivial. Additionally, the impact is limited by only enabling the pollution of functions, and not all generic objects.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "acknowledgments": [ { "names": [ "Marcus Nilsson" ], "organization": "usd AG" } ], "cve": "CVE-2022-1274", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073157" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: HTML injection in execute-actions-email Admin REST API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1274" }, { "category": "external", "summary": "RHBZ#2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1274" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725" } ], "release_date": "2023-02-28T18:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: HTML injection in execute-actions-email Admin REST API" }, { "acknowledgments": [ { "names": [ "Grzegorz Tworek" ], "organization": "SISOFT s.c." } ], "cve": "CVE-2022-1438", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2021-12-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2031904" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS on impersonation under specific circumstances", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1438" }, { "category": "external", "summary": "RHBZ#2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1438", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1438" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438" } ], "release_date": "2023-02-28T18:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS on impersonation under specific circumstances" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-2764", "discovery_date": "2022-08-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2117506" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK from the bytes, causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2764" }, { "category": "external", "summary": "RHBZ#2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2764", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2764" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764" } ], "release_date": "2022-08-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations" }, { "acknowledgments": [ { "names": [ "Peter Flintholm" ], "organization": "Trifork" } ], "cve": "CVE-2022-3916", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2022-11-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2141404" } ], "notes": [ { "category": "description", "text": "A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Session takeover with OIDC offline refreshtokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3916" }, { "category": "external", "summary": "RHBZ#2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3916" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916" } ], "release_date": "2022-11-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: Session takeover with OIDC offline refreshtokens" }, { "cve": "CVE-2022-4137", "cwe": { "id": "CWE-81", "name": "Improper Neutralization of Script in an Error Message Web Page" }, "discovery_date": "2022-11-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2148496" } ], "notes": [ { "category": "description", "text": "A reflected cross-site scripting (XSS) vulnerability was found in the \u0027oob\u0027 OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: reflected XSS attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4137" }, { "category": "external", "summary": "RHBZ#2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4137", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4137" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137" } ], "release_date": "2023-03-01T13:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: reflected XSS attack" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "other", "text": "In Quay 3.10 and above, no version of affected momentjs is present.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-31129", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-07-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2105075" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service (ReDoS) attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "moment: inefficient parsing algorithm resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse provides the affected software but does not use the functionality and as such its impact has been downgraded to Low.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships a vulnerable version of the moment library. However, this affected functionality is restricted behind OAuth, reducing the impact to Moderate.\n\nRed Hat Satellite ships a vulnerable version of the moment library. However, this only affects a specific component (qpid-dispatch), reducing the impact to Moderate.\n\nRed Hat Ceph Storage (RHCS) ships a vulnerable version of the moment library, however, it is not directly used and is a transitive dependency from Angular. In addition, the impact would only be to the grafana browser, and not the underlying RHCS system, which reduces the impact to Moderate. \n\nRed Hat OpenShift Service Mesh (OSSM) ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nRed Hat OpenShift distributed tracing ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nIn Logging Subsystem for Red Hat OpenShift the vulnerable moment nodejs package is bundled in the ose-logging-kibana6 container as a transitive dependency, hence the direct impact is reduced to Moderate.\n\nIn OpenShift Container Platform 4 the vulnerabile moment package is a third party dependency, hence the direct impact is reduced to Moderate.\n\nIn Quay IO 3.10 and above, no version of affected momentjs is present.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31129" }, { "category": "external", "summary": "RHBZ#2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31129", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g", "url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g" } ], "release_date": "2022-07-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "moment: inefficient parsing algorithm resulting in DoS" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-38749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129706" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38749" }, { "category": "external", "summary": "RHBZ#2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38749", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode" }, { "cve": "CVE-2022-38750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129707" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38750" }, { "category": "external", "summary": "RHBZ#2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38750", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject" }, { "cve": "CVE-2022-38751", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129709" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38751" }, { "category": "external", "summary": "RHBZ#2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "CXF: SSRF Vulnerability" }, { "acknowledgments": [ { "names": [ "Sourav Kumar" ], "organization": "https://github.com/souravs17031999", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0091", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Client Registration endpoint does not check token revocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0091" }, { "category": "external", "summary": "RHBZ#2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0091", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0091" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg" }, { "category": "external", "summary": "https://github.com/keycloak/security/issues/27", "url": "https://github.com/keycloak/security/issues/27" } ], "release_date": "2022-10-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: Client Registration endpoint does not check token revocation" }, { "acknowledgments": [ { "names": [ "Jordi Zayuelas i Mu\u00f1oz" ], "organization": "A1 Digital", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0264", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2023-01-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2160585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: user impersonation via stolen uuid code", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0264" }, { "category": "external", "summary": "RHBZ#2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0264", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0264" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264" } ], "release_date": "2023-02-28T18:58:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: user impersonation via stolen uuid code" } ] }
rhsa-2023:0552
Vulnerability from csaf_redhat
Published
2023-01-31 13:15
Modified
2025-07-10 20:17
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
Notes
Topic
An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Untrusted code execution via <option> tag in HTML passed to DOM manipulation methods (CVE-2020-11023)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* bootstrap: XSS in the data-target attribute (CVE-2016-10735)
* bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)
* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)
* nodejs-moment: Regular expression denial of service (CVE-2017-18214)
* wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n\n* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)\n\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n\n* jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods (CVE-2020-11023)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* bootstrap: XSS in the data-target attribute (CVE-2016-10735)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)\n\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n\n* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks (CVE-2022-40152)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n\n* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)\n\n* nodejs-moment: Regular expression denial of service (CVE-2017-18214)\n\n* wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)\n\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0552", "url": "https://access.redhat.com/errata/RHSA-2023:0552" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/" }, { "category": "external", "summary": "1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "1553413", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553413" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601616" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "2124682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124682" }, { "category": "external", "summary": "2134291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134291" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "JBEAP-23864", "url": "https://issues.redhat.com/browse/JBEAP-23864" }, { "category": "external", "summary": "JBEAP-23865", "url": "https://issues.redhat.com/browse/JBEAP-23865" }, { "category": "external", "summary": "JBEAP-23866", "url": "https://issues.redhat.com/browse/JBEAP-23866" }, { "category": "external", "summary": "JBEAP-23926", "url": "https://issues.redhat.com/browse/JBEAP-23926" }, { "category": "external", "summary": "JBEAP-24055", "url": "https://issues.redhat.com/browse/JBEAP-24055" }, { "category": "external", "summary": "JBEAP-24081", "url": "https://issues.redhat.com/browse/JBEAP-24081" }, { "category": "external", "summary": "JBEAP-24095", "url": "https://issues.redhat.com/browse/JBEAP-24095" }, { "category": "external", "summary": "JBEAP-24100", "url": "https://issues.redhat.com/browse/JBEAP-24100" }, { "category": "external", "summary": "JBEAP-24127", "url": "https://issues.redhat.com/browse/JBEAP-24127" }, { "category": "external", "summary": "JBEAP-24128", "url": "https://issues.redhat.com/browse/JBEAP-24128" }, { "category": "external", "summary": "JBEAP-24132", "url": "https://issues.redhat.com/browse/JBEAP-24132" }, { "category": "external", "summary": "JBEAP-24147", "url": "https://issues.redhat.com/browse/JBEAP-24147" }, { "category": "external", "summary": "JBEAP-24167", "url": "https://issues.redhat.com/browse/JBEAP-24167" }, { "category": "external", "summary": "JBEAP-24191", "url": "https://issues.redhat.com/browse/JBEAP-24191" }, { "category": "external", "summary": "JBEAP-24195", "url": "https://issues.redhat.com/browse/JBEAP-24195" }, { "category": "external", "summary": "JBEAP-24207", "url": "https://issues.redhat.com/browse/JBEAP-24207" }, { "category": "external", "summary": "JBEAP-24248", "url": "https://issues.redhat.com/browse/JBEAP-24248" }, { "category": "external", "summary": "JBEAP-24426", "url": "https://issues.redhat.com/browse/JBEAP-24426" }, { "category": "external", "summary": "JBEAP-24427", "url": "https://issues.redhat.com/browse/JBEAP-24427" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0552.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update", "tracking": { "current_release_date": "2025-07-10T20:17:44+00:00", "generator": { "date": "2025-07-10T20:17:44+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2023:0552", "initial_release_date": "2023-01-31T13:15:22+00:00", "revision_history": [ { "date": "2023-01-31T13:15:22+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-01-31T13:15:22+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-10T20:17:44+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product": { "name": "Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform" }, { "branches": [ { "category": "product_version", "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src", "product": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src", "product_id": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-woodstox-core@6.4.0-1.redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-java8@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-elytron-web@1.9.3-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-databind@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "product": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "product_id": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-javaee-security-soteria@1.0.1-3.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-providers@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-annotations@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "product": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "product_id": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jettison@1.5.2-1.redhat_00002.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-core@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "product": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_id": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-base@2.12.7-1.redhat_00003.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "product": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "product_id": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.22-1.SP3_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-remoting@5.0.27-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.16-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.10-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsp-api_2.3_spec@2.0.0-3.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "product": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "product_id": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-sshd@2.9.2-1.redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-ejb-client@4.0.49-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "product": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "product_id": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsf-api_2.3_spec@3.0.0-6.SP07_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search@5.10.13-3.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "product": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "product_id": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.16-1.Final_redhat_00001.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "product_id": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-24.Final_redhat_00023.1.el7eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "product": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "product_id": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.9-4.GA_redhat_00003.1.el7eap?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "product_id": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-woodstox-core@6.4.0-1.redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-datatype-jdk8@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-datatype-jsr310@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-java8@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow-server@1.9.3-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-databind@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product_id": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-javaee-security-soteria@1.0.1-3.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product_id": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-javaee-security-soteria-enterprise@1.0.1-3.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-base@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-json-provider@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-annotations@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "product": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "product_id": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jettison@1.5.2-1.redhat_00002.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-core@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-module-jaxb-annotations@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_id": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-base@2.12.7-1.redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "product_id": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.22-1.SP3_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-remoting@5.0.27-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.16-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-api@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-impl@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-spi@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-api@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-impl@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-deployers-common@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-jdbc@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-validator@1.5.10-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsp-api_2.3_spec@2.0.0-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "product_id": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-sshd@2.9.2-1.redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-ejb-client@4.0.49-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "product_id": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsf-api_2.3_spec@3.0.0-6.SP07_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-backend-jgroups@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-backend-jms@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-engine@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-orm@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-serialization-avro@5.10.13-3.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.16-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product": { "name": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product_id": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron-tool@1.15.16-1.Final_redhat_00001.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_id": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-24.Final_redhat_00023.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_id": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-cli@1.10.0-24.Final_redhat_00023.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product": { "name": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_id": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-core@1.10.0-24.Final_redhat_00023.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_id": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.9-4.GA_redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_id": "eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk11@7.4.9-4.GA_redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_id": "eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-java-jdk8@7.4.9-4.GA_redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_id": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.4.9-4.GA_redhat_00003.1.el7eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product": { "name": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_id": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.4.9-4.GA_redhat_00003.1.el7eap?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src" }, "product_reference": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src" }, "product_reference": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch" }, "product_reference": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch" }, "product_reference": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch" }, "product_reference": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" }, "product_reference": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src" }, "product_reference": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src" }, "product_reference": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" }, "product_reference": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch" }, "product_reference": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "relates_to_product_reference": "7Server-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" }, "product_reference": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src", "relates_to_product_reference": "7Server-JBEAP-7.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-9251", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2016-11-27T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1399546" } ], "notes": [ { "category": "description", "text": "jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting via cross-domain ajax requests", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-9251" }, { "category": "external", "summary": "RHBZ#1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-9251", "url": "https://www.cve.org/CVERecord?id=CVE-2015-9251" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-9251", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9251" } ], "release_date": "2015-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Cross-site scripting via cross-domain ajax requests" }, { "cve": "CVE-2016-10735", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-01-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668097" } ], "notes": [ { "category": "description", "text": "In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the data-target attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.\n\nRed Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-10735" }, { "category": "external", "summary": "RHBZ#1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-10735", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735" } ], "release_date": "2016-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: XSS in the data-target attribute" }, { "cve": "CVE-2017-18214", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-03-08T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1553413" } ], "notes": [ { "category": "description", "text": "The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-moment: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of momentjs as shipped with Red Hat Enterprise Satellite 5. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.\n\nIn Quay 3.10 and above, no version of affected momentjs is present.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-18214" }, { "category": "external", "summary": "RHBZ#1553413", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553413" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-18214", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18214" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-18214", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18214" } ], "release_date": "2017-09-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-moment: Regular expression denial of service" }, { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14041", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601616" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the data-target property of scrollspy. This flaw allows a remote attacker to execute a script in a victim\u0027s Web browser within the security context of the hosting Web site, which can lead to stealing the victim\u0027s cookie-based authentication credentials.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14041" }, { "category": "external", "summary": "RHBZ#1601616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601616" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14041", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14041" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14041", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14041" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-8331", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-02-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1686454" } ], "notes": [ { "category": "description", "text": "A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the tooltip or popover data-template attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-8331" }, { "category": "external", "summary": "RHBZ#1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-8331", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8331" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331" } ], "release_date": "2019-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: XSS in the tooltip or popover data-template attribute" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis controls ensure that security flaws, including XSS vulnerabilities, are detected early in development by scanning code for improper input handling. This prevents vulnerable code from reaching production and encourages our developers to follow secure coding practices. System monitoring controls play a crucial role in detecting and responding to XSS attacks by analyzing logs, monitoring user behavior, and generating alerts for suspicious activity. Meanwhile, AWS WAF (Web Application Firewall) adds an extra layer of defense by filtering and blocking malicious input before it reaches the platform and/or application. Together, these controls create a defense-in-depth approach, reducing the risk of XSS exploitation by preventing, detecting, and mitigating attacks at multiple levels.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "exploit_status", "date": "2025-01-23T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Low" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2022-3143", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-09-06T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2124682" } ], "notes": [ { "category": "description", "text": "A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.", "title": "Vulnerability description" }, { "category": "summary", "text": "wildfly-elytron: possible timing attacks via use of unsafe comparator", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3143" }, { "category": "external", "summary": "RHBZ#2124682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3143", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3143" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3143", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3143" } ], "release_date": "2022-09-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "wildfly-elytron: possible timing attacks via use of unsafe comparator" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-40152", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134291" } ], "notes": [ { "category": "description", "text": "A flaw was found in the FasterXML/woodstox package. This flaw allows an attacker to cause a denial of service (DoS) in its target via XML serialization. An attacker may benefit from the parser sending a malicious input that may cause a crash. This vulnerability is only relevant for users using the DTD parsing functionality.", "title": "Vulnerability description" }, { "category": "summary", "text": "woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40152" }, { "category": "external", "summary": "RHBZ#2134291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134291" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40152", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40152" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40152", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40152" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-3f7h-mf4q-vrm4", "url": "https://github.com/advisories/GHSA-3f7h-mf4q-vrm4" } ], "release_date": "2022-09-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "known_not_affected": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:22+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0552" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el7eap.src", "7Server-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el7eap.src", "7Server-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk11-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-java-jdk8-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.noarch", "7Server-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el7eap.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "CXF: SSRF Vulnerability" } ] }
rhsa-2023_1045
Vulnerability from csaf_redhat
Published
2023-03-01 21:45
Modified
2024-12-18 00:38
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9
Notes
Topic
New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.2 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* keycloak: missing email notification template allowlist (CVE-2022-1274)
* keycloak: minimist: prototype pollution (CVE-2021-44906)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)
* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
* keycloak: path traversal via double URL encoding (CVE-2022-3782)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
* keycloak: reflected XSS attack (CVE-2022-4137)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.2 on RHEL 9 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n* keycloak: missing email notification template allowlist (CVE-2022-1274)\n* keycloak: minimist: prototype pollution (CVE-2021-44906)\n* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)\n* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)\n* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)\n* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)\n* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)\n* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n* jquery: Passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n* keycloak: reflected XSS attack (CVE-2022-4137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1045", "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1045.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 9", "tracking": { "current_release_date": "2024-12-18T00:38:05+00:00", "generator": { "date": "2024-12-18T00:38:05+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2023:1045", "initial_release_date": "2023-03-01T21:45:17+00:00", "revision_history": [ { "date": "2023-03-01T21:45:17+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-01T21:45:17+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-18T00:38:05+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.6 for RHEL 9", "product": { "name": "Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6::el9" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el9sso?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el9sso?arch=noarch" } } }, { "category": "product_version", "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_id": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak-server@18.0.6-1.redhat_00001.1.el9sso?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "relates_to_product_reference": "9Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "relates_to_product_reference": "9Base-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 9", "product_id": "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" }, "product_reference": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "relates_to_product_reference": "9Base-RHSSO-7.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. However, the vulnerability has not been found to be exploitable in reasonable scenarios. \n\nIn RHEL7, pcs-0.9.169-3.el7_9.3 [RHSA-2022:7343] contains an updated version of jquery (3.6.0), which does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. This flaw allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. While this flaw (CVE-2021-44906) enables attackers to control objects that they should not have access to, actual exploitation would still require a chain of independent flaws. Even though the CVSS for CVE-2021-44906 is higher than CVE-2020-7598, they are both rated as having Moderate impact.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "acknowledgments": [ { "names": [ "Marcus Nilsson" ], "organization": "usd AG" } ], "cve": "CVE-2022-1274", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073157" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: HTML injection in execute-actions-email Admin REST API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1274" }, { "category": "external", "summary": "RHBZ#2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1274" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725" } ], "release_date": "2023-02-28T18:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: HTML injection in execute-actions-email Admin REST API" }, { "acknowledgments": [ { "names": [ "Grzegorz Tworek" ], "organization": "SISOFT s.c." } ], "cve": "CVE-2022-1438", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2021-12-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2031904" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS on impersonation under specific circumstances", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1438" }, { "category": "external", "summary": "RHBZ#2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1438", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1438" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438" } ], "release_date": "2023-02-28T18:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS on impersonation under specific circumstances" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-2764", "discovery_date": "2022-08-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2117506" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK from the bytes, causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2764" }, { "category": "external", "summary": "RHBZ#2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2764", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2764" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764" } ], "release_date": "2022-08-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations" }, { "acknowledgments": [ { "names": [ "Peter Flintholm" ], "organization": "Trifork" } ], "cve": "CVE-2022-3916", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2022-11-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2141404" } ], "notes": [ { "category": "description", "text": "A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Session takeover with OIDC offline refreshtokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3916" }, { "category": "external", "summary": "RHBZ#2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3916" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916" } ], "release_date": "2022-11-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: Session takeover with OIDC offline refreshtokens" }, { "cve": "CVE-2022-4137", "cwe": { "id": "CWE-81", "name": "Improper Neutralization of Script in an Error Message Web Page" }, "discovery_date": "2022-11-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2148496" } ], "notes": [ { "category": "description", "text": "A reflected cross-site scripting (XSS) vulnerability was found in the \u0027oob\u0027 OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: reflected XSS attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4137" }, { "category": "external", "summary": "RHBZ#2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4137", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4137" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137" } ], "release_date": "2023-03-01T13:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: reflected XSS attack" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-31129", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-07-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2105075" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service (ReDoS) attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "moment: inefficient parsing algorithm resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse provides the affected software but does not use the functionality and as such its impact has been downgraded to Low.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships a vulnerable version of the moment library. However, this affected functionality is restricted behind OAuth, reducing the impact to Moderate.\n\nRed Hat Satellite ships a vulnerable version of the moment library. However, this only affects a specific component (qpid-dispatch), reducing the impact to Moderate.\n\nRed Hat Ceph Storage (RHCS) ships a vulnerable version of the moment library, however, it is not directly used and is a transitive dependency from Angular. In addition, the impact would only be to the grafana browser, and not the underlying RHCS system, which reduces the impact to Moderate. \n\nRed Hat OpenShift Service Mesh (OSSM) ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nRed Hat OpenShift distributed tracing ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nIn Logging Subsystem for Red Hat OpenShift the vulnerable moment nodejs package is bundled in the ose-logging-kibana6 container as a transitive dependency, hence the direct impact is reduced to Moderate.\n\nIn OpenShift Container Platform 4 the vulnerabile moment package is a third party dependency, hence the direct impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31129" }, { "category": "external", "summary": "RHBZ#2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31129", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g", "url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g" } ], "release_date": "2022-07-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "moment: inefficient parsing algorithm resulting in DoS" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-38749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129706" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38749" }, { "category": "external", "summary": "RHBZ#2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38749", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode" }, { "cve": "CVE-2022-38750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129707" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38750" }, { "category": "external", "summary": "RHBZ#2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38750", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject" }, { "cve": "CVE-2022-38751", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129709" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38751" }, { "category": "external", "summary": "RHBZ#2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "CXF: SSRF Vulnerability" }, { "acknowledgments": [ { "names": [ "Sourav Kumar" ], "organization": "https://github.com/souravs17031999", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0091", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Client Registration endpoint does not check token revocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0091" }, { "category": "external", "summary": "RHBZ#2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0091", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0091" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg" }, { "category": "external", "summary": "https://github.com/keycloak/security/issues/27", "url": "https://github.com/keycloak/security/issues/27" } ], "release_date": "2022-10-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: Client Registration endpoint does not check token revocation" }, { "acknowledgments": [ { "names": [ "Jordi Zayuelas i Mu\u00f1oz" ], "organization": "A1 Digital", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0264", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2023-01-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2160585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: user impersonation via stolen uuid code", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0264" }, { "category": "external", "summary": "RHBZ#2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0264", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0264" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264" } ], "release_date": "2023-02-28T18:58:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:45:17+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1045" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.noarch", "9Base-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el9sso.src", "9Base-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el9sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: user impersonation via stolen uuid code" } ] }
rhsa-2023_0556
Vulnerability from csaf_redhat
Published
2023-01-31 13:18
Modified
2024-12-16 02:19
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
Notes
Topic
An update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* jquery: Prototype pollution in object's prototype leading to denial of
service, remote code execution, or property injection (CVE-2019-11358)
* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Untrusted code execution via <option> tag in HTML passed to DOM
manipulation methods (CVE-2020-11023)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* bootstrap: XSS in the data-target attribute (CVE-2016-10735)
* bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of
Service attacks (CVE-2022-40152)
* bootstrap: Cross-site Scripting (XSS) in the data-container property of
tooltip (CVE-2018-14042)
* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)
* nodejs-moment: Regular expression denial of service (CVE-2017-18214)
* wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat JBoss Enterprise Application Platform 7.4. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of\nservice, remote code execution, or property injection (CVE-2019-11358)\n\n* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)\n\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n\n* jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM\nmanipulation methods (CVE-2020-11023)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* bootstrap: XSS in the data-target attribute (CVE-2016-10735)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy (CVE-2018-14041)\n\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n\n* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of\nService attacks (CVE-2022-40152)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-container property of\ntooltip (CVE-2018-14042)\n\n* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)\n\n* nodejs-moment: Regular expression denial of service (CVE-2017-18214)\n\n* wildfly-elytron: possible timing attacks via use of unsafe comparator (CVE-2022-3143)\n\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0556", "url": "https://access.redhat.com/errata/RHSA-2023:0556" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=appplatform\u0026version=7.4", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=appplatform\u0026version=7.4" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/" }, { "category": "external", "summary": "1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "1553413", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553413" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601616" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "2124682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124682" }, { "category": "external", "summary": "2134291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134291" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "JBEAP-23864", "url": "https://issues.redhat.com/browse/JBEAP-23864" }, { "category": "external", "summary": "JBEAP-23865", "url": "https://issues.redhat.com/browse/JBEAP-23865" }, { "category": "external", "summary": "JBEAP-23866", "url": "https://issues.redhat.com/browse/JBEAP-23866" }, { "category": "external", "summary": "JBEAP-24055", "url": "https://issues.redhat.com/browse/JBEAP-24055" }, { "category": "external", "summary": "JBEAP-24081", "url": "https://issues.redhat.com/browse/JBEAP-24081" }, { "category": "external", "summary": "JBEAP-24095", "url": "https://issues.redhat.com/browse/JBEAP-24095" }, { "category": "external", "summary": "JBEAP-24100", "url": "https://issues.redhat.com/browse/JBEAP-24100" }, { "category": "external", "summary": "JBEAP-24127", "url": "https://issues.redhat.com/browse/JBEAP-24127" }, { "category": "external", "summary": "JBEAP-24128", "url": "https://issues.redhat.com/browse/JBEAP-24128" }, { "category": "external", "summary": "JBEAP-24132", "url": "https://issues.redhat.com/browse/JBEAP-24132" }, { "category": "external", "summary": "JBEAP-24147", "url": "https://issues.redhat.com/browse/JBEAP-24147" }, { "category": "external", "summary": "JBEAP-24167", "url": "https://issues.redhat.com/browse/JBEAP-24167" }, { "category": "external", "summary": "JBEAP-24191", "url": "https://issues.redhat.com/browse/JBEAP-24191" }, { "category": "external", "summary": "JBEAP-24195", "url": "https://issues.redhat.com/browse/JBEAP-24195" }, { "category": "external", "summary": "JBEAP-24207", "url": "https://issues.redhat.com/browse/JBEAP-24207" }, { "category": "external", "summary": "JBEAP-24248", "url": "https://issues.redhat.com/browse/JBEAP-24248" }, { "category": "external", "summary": "JBEAP-24426", "url": "https://issues.redhat.com/browse/JBEAP-24426" }, { "category": "external", "summary": "JBEAP-24427", "url": "https://issues.redhat.com/browse/JBEAP-24427" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0556.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update", "tracking": { "current_release_date": "2024-12-16T02:19:57+00:00", "generator": { "date": "2024-12-16T02:19:57+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.3" } }, "id": "RHSA-2023:0556", "initial_release_date": "2023-01-31T13:18:26+00:00", "revision_history": [ { "date": "2023-01-31T13:18:26+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-01-31T13:18:26+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-12-16T02:19:57+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform 7", "product": { "name": "Red Hat JBoss Enterprise Application Platform 7", "product_id": "Red Hat JBoss Enterprise Application Platform 7", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-9251", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2016-11-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1399546" } ], "notes": [ { "category": "description", "text": "jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting via cross-domain ajax requests", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-9251" }, { "category": "external", "summary": "RHBZ#1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-9251", "url": "https://www.cve.org/CVERecord?id=CVE-2015-9251" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-9251", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9251" } ], "release_date": "2015-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Cross-site scripting via cross-domain ajax requests" }, { "cve": "CVE-2016-10735", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-01-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668097" } ], "notes": [ { "category": "description", "text": "In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the data-target attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.\n\nRed Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-10735" }, { "category": "external", "summary": "RHBZ#1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-10735", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735" } ], "release_date": "2016-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: XSS in the data-target attribute" }, { "cve": "CVE-2017-18214", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-03-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1553413" } ], "notes": [ { "category": "description", "text": "The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-moment: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of momentjs as shipped with Red Hat Enterprise Satellite 5. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-18214" }, { "category": "external", "summary": "RHBZ#1553413", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553413" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-18214", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18214" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-18214", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18214" } ], "release_date": "2017-09-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-moment: Regular expression denial of service" }, { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14041", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601616" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the data-target property of scrollspy. This flaw allows a remote attacker to execute a script in a victim\u0027s Web browser within the security context of the hosting Web site, which can lead to stealing the victim\u0027s cookie-based authentication credentials.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14041" }, { "category": "external", "summary": "RHBZ#1601616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601616" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14041", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14041" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14041", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14041" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-8331", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1686454" } ], "notes": [ { "category": "description", "text": "A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the tooltip or popover data-template attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-8331" }, { "category": "external", "summary": "RHBZ#1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-8331", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8331" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331" } ], "release_date": "2019-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: XSS in the tooltip or popover data-template attribute" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. However, the vulnerability has not been found to be exploitable in reasonable scenarios. \n\nIn RHEL7, pcs-0.9.169-3.el7_9.3 [RHSA-2022:7343] contains an updated version of jquery (3.6.0), which does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2022-3143", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-09-06T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2124682" } ], "notes": [ { "category": "description", "text": "A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.", "title": "Vulnerability description" }, { "category": "summary", "text": "wildfly-elytron: possible timing attacks via use of unsafe comparator", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3143" }, { "category": "external", "summary": "RHBZ#2124682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3143", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3143" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3143", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3143" } ], "release_date": "2022-09-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "wildfly-elytron: possible timing attacks via use of unsafe comparator" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-40152", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134291" } ], "notes": [ { "category": "description", "text": "A flaw was found in the FasterXML/woodstox package. This flaw allows an attacker to cause a denial of service (DoS) in its target via XML serialization. An attacker may benefit from the parser sending a malicious input that may cause a crash. This vulnerability is only relevant for users using the DTD parsing functionality.", "title": "Vulnerability description" }, { "category": "summary", "text": "woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40152" }, { "category": "external", "summary": "RHBZ#2134291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134291" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40152", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40152" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40152", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40152" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-3f7h-mf4q-vrm4", "url": "https://github.com/advisories/GHSA-3f7h-mf4q-vrm4" } ], "release_date": "2022-09-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat JBoss Enterprise Application Platform 7" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:18:26+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "Red Hat JBoss Enterprise Application Platform 7" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0556" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat JBoss Enterprise Application Platform 7" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "CXF: SSRF Vulnerability" } ] }
RHSA-2023:1043
Vulnerability from csaf_redhat
Published
2023-03-01 22:02
Modified
2025-07-16 19:52
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7
Notes
Topic
New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.6.2 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* keycloak: missing email notification template allowlist (CVE-2022-1274)
* keycloak: minimist: prototype pollution (CVE-2021-44906)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)
* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
* keycloak: path traversal via double URL encoding (CVE-2022-3782)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
* keycloak: reflected XSS attack (CVE-2022-4137)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "New Red Hat Single Sign-On 7.6.2 packages are now available for Red Hat Enterprise Linux 7.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.6 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.6.2 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.6.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: XSS on impersonation under specific circumstances (CVE-2022-1438)\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n* keycloak: missing email notification template allowlist (CVE-2022-1274)\n* keycloak: minimist: prototype pollution (CVE-2021-44906)\n* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)\n* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)\n* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)\n* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)\n* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)\n* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n* jquery: Passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n* keycloak: reflected XSS attack (CVE-2022-4137)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1043", "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1043.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 security update on RHEL 7", "tracking": { "current_release_date": "2025-07-16T19:52:53+00:00", "generator": { "date": "2025-07-16T19:52:53+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2023:1043", "initial_release_date": "2023-03-01T22:02:40+00:00", "revision_history": [ { "date": "2023-03-01T22:02:40+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-01T22:02:40+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-16T19:52:53+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product": { "name": "Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6", "product_identification_helper": { "cpe": "cpe:/a:redhat:red_hat_single_sign_on:7.6::el7" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el7sso?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_id": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak@18.0.6-1.redhat_00001.1.el7sso?arch=noarch" } } }, { "category": "product_version", "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_id": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rh-sso7-keycloak-server@18.0.6-1.redhat_00001.1.el7sso?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "relates_to_product_reference": "7Server-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src" }, "product_reference": "rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "relates_to_product_reference": "7Server-RHSSO-7.6" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch as a component of Red Hat Single Sign-On 7.6 for RHEL 7 Server", "product_id": "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" }, "product_reference": "rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "relates_to_product_reference": "7Server-RHSSO-7.6" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis controls ensure that security flaws, including XSS vulnerabilities, are detected early in development by scanning code for improper input handling. This prevents vulnerable code from reaching production and encourages our developers to follow secure coding practices. System monitoring controls play a crucial role in detecting and responding to XSS attacks by analyzing logs, monitoring user behavior, and generating alerts for suspicious activity. Meanwhile, AWS WAF (Web Application Firewall) adds an extra layer of defense by filtering and blocking malicious input before it reaches the platform and/or application. Together, these controls create a defense-in-depth approach, reducing the risk of XSS exploitation by preventing, detecting, and mitigating attacks at multiple levels.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "exploit_status", "date": "2025-01-23T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw (CVE-2021-44906) allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "As minimist is an argument parsing module for nodejs, exploitation of this vulnerability requires an attacker to influence which arguments are passed to nodejs when running a script. Red Hat products and services are designed in such a way that gaining this ability is not trivial. Additionally, the impact is limited by only enabling the pollution of functions, and not all generic objects.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "acknowledgments": [ { "names": [ "Marcus Nilsson" ], "organization": "usd AG" } ], "cve": "CVE-2022-1274", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073157" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: HTML injection in execute-actions-email Admin REST API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1274" }, { "category": "external", "summary": "RHBZ#2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1274" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725" } ], "release_date": "2023-02-28T18:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: HTML injection in execute-actions-email Admin REST API" }, { "acknowledgments": [ { "names": [ "Grzegorz Tworek" ], "organization": "SISOFT s.c." } ], "cve": "CVE-2022-1438", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2021-12-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2031904" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS on impersonation under specific circumstances", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1438" }, { "category": "external", "summary": "RHBZ#2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1438", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1438" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438" } ], "release_date": "2023-02-28T18:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS on impersonation under specific circumstances" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-2764", "discovery_date": "2022-08-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2117506" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK from the bytes, causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2764" }, { "category": "external", "summary": "RHBZ#2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2764", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2764" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764" } ], "release_date": "2022-08-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations" }, { "acknowledgments": [ { "names": [ "Peter Flintholm" ], "organization": "Trifork" } ], "cve": "CVE-2022-3916", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2022-11-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2141404" } ], "notes": [ { "category": "description", "text": "A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Session takeover with OIDC offline refreshtokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3916" }, { "category": "external", "summary": "RHBZ#2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3916" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916" } ], "release_date": "2022-11-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: Session takeover with OIDC offline refreshtokens" }, { "cve": "CVE-2022-4137", "cwe": { "id": "CWE-81", "name": "Improper Neutralization of Script in an Error Message Web Page" }, "discovery_date": "2022-11-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2148496" } ], "notes": [ { "category": "description", "text": "A reflected cross-site scripting (XSS) vulnerability was found in the \u0027oob\u0027 OAuth endpoint due to incorrect null-byte handling. This issue allows a malicious link to insert an arbitrary URI into a Keycloak error page. This flaw requires a user or administrator to interact with a link in order to be vulnerable. This may compromise user details, allowing it to be changed or collected by an attacker.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: reflected XSS attack", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4137" }, { "category": "external", "summary": "RHBZ#2148496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2148496" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4137", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4137" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4137" } ], "release_date": "2023-03-01T13:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: reflected XSS attack" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "other", "text": "In Quay 3.10 and above, no version of affected momentjs is present.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-31129", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-07-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2105075" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service (ReDoS) attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "moment: inefficient parsing algorithm resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse provides the affected software but does not use the functionality and as such its impact has been downgraded to Low.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships a vulnerable version of the moment library. However, this affected functionality is restricted behind OAuth, reducing the impact to Moderate.\n\nRed Hat Satellite ships a vulnerable version of the moment library. However, this only affects a specific component (qpid-dispatch), reducing the impact to Moderate.\n\nRed Hat Ceph Storage (RHCS) ships a vulnerable version of the moment library, however, it is not directly used and is a transitive dependency from Angular. In addition, the impact would only be to the grafana browser, and not the underlying RHCS system, which reduces the impact to Moderate. \n\nRed Hat OpenShift Service Mesh (OSSM) ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nRed Hat OpenShift distributed tracing ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nIn Logging Subsystem for Red Hat OpenShift the vulnerable moment nodejs package is bundled in the ose-logging-kibana6 container as a transitive dependency, hence the direct impact is reduced to Moderate.\n\nIn OpenShift Container Platform 4 the vulnerabile moment package is a third party dependency, hence the direct impact is reduced to Moderate.\n\nIn Quay IO 3.10 and above, no version of affected momentjs is present.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31129" }, { "category": "external", "summary": "RHBZ#2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31129", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g", "url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g" } ], "release_date": "2022-07-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "moment: inefficient parsing algorithm resulting in DoS" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-38749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129706" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38749" }, { "category": "external", "summary": "RHBZ#2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38749", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode" }, { "cve": "CVE-2022-38750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129707" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38750" }, { "category": "external", "summary": "RHBZ#2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38750", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject" }, { "cve": "CVE-2022-38751", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129709" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38751" }, { "category": "external", "summary": "RHBZ#2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "CXF: SSRF Vulnerability" }, { "acknowledgments": [ { "names": [ "Sourav Kumar" ], "organization": "https://github.com/souravs17031999", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0091", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Client Registration endpoint does not check token revocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0091" }, { "category": "external", "summary": "RHBZ#2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0091", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0091" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg" }, { "category": "external", "summary": "https://github.com/keycloak/security/issues/27", "url": "https://github.com/keycloak/security/issues/27" } ], "release_date": "2022-10-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: Client Registration endpoint does not check token revocation" }, { "acknowledgments": [ { "names": [ "Jordi Zayuelas i Mu\u00f1oz" ], "organization": "A1 Digital", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0264", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2023-01-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2160585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: user impersonation via stolen uuid code", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0264" }, { "category": "external", "summary": "RHBZ#2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0264", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0264" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264" } ], "release_date": "2023-02-28T18:58:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T22:02:40+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1043" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.noarch", "7Server-RHSSO-7.6:rh-sso7-keycloak-0:18.0.6-1.redhat_00001.1.el7sso.src", "7Server-RHSSO-7.6:rh-sso7-keycloak-server-0:18.0.6-1.redhat_00001.1.el7sso.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: user impersonation via stolen uuid code" } ] }
rhsa-2023:1047
Vulnerability from csaf_redhat
Published
2023-03-01 21:46
Modified
2025-07-16 19:53
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update
Notes
Topic
A new image is available for Red Hat Single Sign-On 7.6.2, running on Red
Hat OpenShift Container Platform from the release of 3.11 up to the release
of 4.12.0.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On is an integrated sign-on solution, available as a
Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat
Single Sign-On for OpenShift image provides an authentication server that
you can use to log in centrally, log out, and register. You can also manage
user accounts for web applications, mobile applications, and RESTful web
services.
* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)
* keycloak: path traversal via double URL encoding (CVE-2022-3782)
* RH-SSO for OpenShift images: unsecured management interface exposed to adjacent network (CVE-2022-4039)
* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)
* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)
* keycloak: minimist: prototype pollution (CVE-2021-44906)
* keycloak: missing email notification template allowlist (CVE-2022-1274)
* keycloak: XSS on izmpersonation under specific circumstances (CVE-2022-1438)
* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)
* Moment.js: Path traversal in moment.locale (CVE-2022-24785)
* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)
* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)
* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)
* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)
* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)
This erratum releases a new image for Red Hat Single Sign-On 7.6.2 for use
within the Red Hat OpenShift Container Platform (from the release of 3.11
up to the release of 4.12.0) cloud computing Platform-as-a-Service (PaaS)
for on-premise or private cloud deployments, aligning with the standalone
product release.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A new image is available for Red Hat Single Sign-On 7.6.2, running on Red\nHat OpenShift Container Platform from the release of 3.11 up to the release\nof 4.12.0.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On is an integrated sign-on solution, available as a\nRed Hat JBoss Middleware for OpenShift containerized image. The Red Hat\nSingle Sign-On for OpenShift image provides an authentication server that\nyou can use to log in centrally, log out, and register. You can also manage\nuser accounts for web applications, mobile applications, and RESTful web\nservices.\n\n* snakeyaml: Constructor Deserialization Remote Code Execution (CVE-2022-1471)\n* keycloak: path traversal via double URL encoding (CVE-2022-3782)\n* RH-SSO for OpenShift images: unsecured management interface exposed to adjacent network (CVE-2022-4039)\n* snakeyaml: Denial of Service due to missing nested depth limitation for collections (CVE-2022-25857)\n* moment: inefficient parsing algorithm resulting in DoS (CVE-2022-31129)\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)\n* keycloak: keycloak: user impersonation via stolen uuid code (CVE-2023-0264)\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n* rcue-bootstrap: bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n* keycloak: glob-parent: Regular Expression Denial of Service (CVE-2021-35065)\n* keycloak: minimist: prototype pollution (CVE-2021-44906)\n* keycloak: missing email notification template allowlist (CVE-2022-1274)\n* keycloak: XSS on izmpersonation under specific circumstances (CVE-2022-1438)\n* keycloak: Session takeover with OIDC offline refreshtokens (CVE-2022-3916)\n* Moment.js: Path traversal in moment.locale (CVE-2022-24785)\n* loader-utils: loader-utils:Regular expression denial of service (CVE-2022-37603)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode (CVE-2022-38749)\n* snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject (CVE-2022-38750)\n* snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match (CVE-2022-38751)\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n* jettison: memory exhaustion via user-supplied XML or JSON data (CVE-2022-40150)\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n* json5: Prototype Pollution in JSON5 via Parse Method (CVE-2022-46175)\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS (CVE-2022-42003)\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n* CXF: Apache CXF: directory listing / code exfiltration (CVE-2022-46363)\n* undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations (CVE-2022-2764)\n* keycloak: Client Registration endpoint does not check token revocation (CVE-2023-0091)\n\nThis erratum releases a new image for Red Hat Single Sign-On 7.6.2 for use\nwithin the Red Hat OpenShift Container Platform (from the release of 3.11\nup to the release of 4.12.0) cloud computing Platform-as-a-Service (PaaS)\nfor on-premise or private cloud deployments, aligning with the standalone\nproduct release.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:1047", "url": "https://access.redhat.com/errata/RHSA-2023:1047" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "2143416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143416" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_1047.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.6.2 for OpenShift image security and enhancement update", "tracking": { "current_release_date": "2025-07-16T19:53:17+00:00", "generator": { "date": "2025-07-16T19:53:17+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2023:1047", "initial_release_date": "2023-03-01T21:46:46+00:00", "revision_history": [ { "date": "2023-03-01T21:46:46+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-03-01T21:46:46+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-16T19:53:17+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Middleware Containers for OpenShift", "product": { "name": "Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhosemc:1.0::el8" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21?arch=s390x\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-20" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60?arch=ppc64le\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-20" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "product": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "product_id": "rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "product_identification_helper": { "purl": "pkg:oci/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f?arch=amd64\u0026repository_url=registry.redhat.io/rh-sso-7/sso76-openshift-rhel8\u0026tag=7.6-20" } } } ], "category": "architecture", "name": "amd64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "relates_to_product_reference": "8Base-RHOSE-Middleware" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64 as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "relates_to_product_reference": "8Base-RHOSE-Middleware" }, { "category": "default_component_of", "full_product_name": { "name": "rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x as a component of Middleware Containers for OpenShift", "product_id": "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" }, "product_reference": "rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x", "relates_to_product_reference": "8Base-RHOSE-Middleware" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2021-35065", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156324" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in the glob-parent package. Affected versions of this package are vulnerable to Regular expression Denial of Service (ReDoS) attacks, affecting system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "glob-parent: Regular Expression Denial of Service", "title": "Vulnerability summary" }, { "category": "other", "text": "The glob-parent package is a transitive dependency and this is not used directly in any of the Red Hat products. Hence, the impact is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-35065" }, { "category": "external", "summary": "RHBZ#2156324", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156324" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-35065", "url": "https://www.cve.org/CVERecord?id=CVE-2021-35065" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-35065" }, { "category": "external", "summary": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294", "url": "https://security.snyk.io/vuln/SNYK-JS-GLOBPARENT-1314294" } ], "release_date": "2022-12-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "glob-parent: Regular Expression Denial of Service" }, { "cve": "CVE-2021-44906", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-03-19T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2066009" } ], "notes": [ { "category": "description", "text": "An Uncontrolled Resource Consumption flaw was found in minimist. The original fix for CVE-2020-7598 was incomplete as it was still possible to bypass in some cases. This flaw (CVE-2021-44906) allows an attacker to trick the library into adding or modifying the properties of Object.prototype, using a constructor or __proto__ payload, resulting in prototype pollution and loss of confidentiality, availability, and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "minimist: prototype pollution", "title": "Vulnerability summary" }, { "category": "other", "text": "As minimist is an argument parsing module for nodejs, exploitation of this vulnerability requires an attacker to influence which arguments are passed to nodejs when running a script. Red Hat products and services are designed in such a way that gaining this ability is not trivial. Additionally, the impact is limited by only enabling the pollution of functions, and not all generic objects.\n\nWithin Red Hat Satellite 6 this flaw has been rated as having a security impact of Low. It is not currently planned to be addressed there, as the minimist library is only included in the -doc subpackage and is part of test fixtures that are not in the execution path used by the rabl gem.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2021-44906" }, { "category": "external", "summary": "RHBZ#2066009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2066009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2021-44906", "url": "https://www.cve.org/CVERecord?id=CVE-2021-44906" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-44906" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-xvch-5gv4-984h", "url": "https://github.com/advisories/GHSA-xvch-5gv4-984h" } ], "release_date": "2022-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.1, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "minimist: prototype pollution" }, { "acknowledgments": [ { "names": [ "Marcus Nilsson" ], "organization": "usd AG" } ], "cve": "CVE-2022-1274", "cwe": { "id": "CWE-80", "name": "Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)" }, "discovery_date": "2022-04-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2073157" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak in the execute-actions-email endpoint. This issue allows arbitrary HTML to be injected into emails sent to Keycloak users and can be misused to perform phishing or other attacks against users.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: HTML injection in execute-actions-email Admin REST API", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1274" }, { "category": "external", "summary": "RHBZ#2073157", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2073157" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1274", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1274" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1274" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-m4fv-gm5m-4725" } ], "release_date": "2023-02-28T18:57:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: HTML injection in execute-actions-email Admin REST API" }, { "acknowledgments": [ { "names": [ "Grzegorz Tworek" ], "organization": "SISOFT s.c." } ], "cve": "CVE-2022-1438", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2021-12-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2031904" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak. Under specific circumstances, HTML entities are not sanitized during user impersonation, resulting in a Cross-site scripting (XSS) vulnerability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: XSS on impersonation under specific circumstances", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1438" }, { "category": "external", "summary": "RHBZ#2031904", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2031904" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1438", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1438" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1438" } ], "release_date": "2023-02-28T18:56:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: XSS on impersonation under specific circumstances" }, { "cve": "CVE-2022-1471", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2150009" } ], "notes": [ { "category": "description", "text": "A flaw was found in the SnakeYaml package. This flaw allows an attacker to benefit from remote code execution by sending malicious YAML content and this content being deserialized by the constructor. Deserialization is unsafe and leads to Remote Code Execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "SnakeYaml: Constructor Deserialization Remote Code Execution", "title": "Vulnerability summary" }, { "category": "other", "text": "In the Red Hat Process Automation 7 (RHPAM) the untrusted, malicious YAML file for deserialization by the vulnerable Snakeyaml\u0027s SafeConstructor class must be provided intentionally by the RHPAM user which requires high privileges. The potential attack complexity is also high because it depends on conditions that are beyond the attacker\u0027s control. Due to that the impact for RHPAM is reduced to Low.\n\nRed Hat Fuse 7 does not expose by default any endpoint that passes incoming data/request into vulnerable Snakeyaml\u0027s Constructor class nor pass untrusted data to this class. When this class is used, it\u2019s still only used to parse internal configuration, hence the impact by this vulnerability to Red Hat Fuse 7 is reduced to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-1471" }, { "category": "external", "summary": "RHBZ#2150009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2150009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-1471", "url": "https://www.cve.org/CVERecord?id=CVE-2022-1471" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1471" }, { "category": "external", "summary": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2", "url": "https://github.com/google/security-research/security/advisories/GHSA-mjmj-j48q-9wg2" } ], "release_date": "2022-10-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "SnakeYaml: Constructor Deserialization Remote Code Execution" }, { "cve": "CVE-2022-2764", "discovery_date": "2022-08-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2117506" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow with EJB invocations. This flaw allows an attacker to generate a valid HTTP request and send it to the server on an established connection after removing the LAST_CHUNK from the bytes, causing a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-2764" }, { "category": "external", "summary": "RHBZ#2117506", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2117506" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-2764", "url": "https://www.cve.org/CVERecord?id=CVE-2022-2764" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-2764" } ], "release_date": "2022-08-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 4.2, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Undertow: DoS can be achieved as Undertow server waits for the LAST_CHUNK forever for EJB invocations" }, { "cve": "CVE-2022-3782", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-10-31T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2138971" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it does not properly validate URLs included in a redirect. An attacker can use this flaw to construct a malicious request to bypass validation and access other URLs and potentially sensitive information within the domain or possibly conduct further attacks. This flaw affects any client that utilizes a wildcard in the Valid Redirect URIs field.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: path traversal via double URL encoding", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not impacted as this CVE affects the server-side Keycloak execution but Quarkus only acts as a Keycloak client in its quarkus-keycloak-authorization extension. For this reason Quarkus is marked with Low impact.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3782" }, { "category": "external", "summary": "RHBZ#2138971", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2138971" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3782", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3782" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3782", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3782" } ], "release_date": "2022-12-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: path traversal via double URL encoding" }, { "acknowledgments": [ { "names": [ "Peter Flintholm" ], "organization": "Trifork" } ], "cve": "CVE-2022-3916", "cwe": { "id": "CWE-384", "name": "Session Fixation" }, "discovery_date": "2022-11-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2141404" } ], "notes": [ { "category": "description", "text": "A flaw was found in the offline_access scope in Keycloak. This issue would affect users of shared computers more (especially if cookies are not cleared), due to a lack of root session validation, and the reuse of session ids across root and user authentication sessions. This enables an attacker to resolve a user session attached to a previously authenticated user; when utilizing the refresh token, they will be issued a token for the original user.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Session takeover with OIDC offline refreshtokens", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3916" }, { "category": "external", "summary": "RHBZ#2141404", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2141404" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3916", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3916" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3916" } ], "release_date": "2022-11-09T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: Session takeover with OIDC offline refreshtokens" }, { "acknowledgments": [ { "names": [ "Thibault Guittet" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2022-4039", "cwe": { "id": "CWE-276", "name": "Incorrect Default Permissions" }, "discovery_date": "2022-11-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2143416" } ], "notes": [ { "category": "description", "text": "A flaw was found in Red Hat Single Sign-On for OpenShift container images, which are configured with an unsecured management interface enabled. This flaw allows an attacker to use this interface to deploy malicious code and access and modify potentially sensitive information in the app server configuration.", "title": "Vulnerability description" }, { "category": "summary", "text": "rhsso-container-image: unsecured management interface exposed to adjecent network", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-4039" }, { "category": "external", "summary": "RHBZ#2143416", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2143416" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-4039", "url": "https://www.cve.org/CVERecord?id=CVE-2022-4039" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-4039", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-4039" } ], "release_date": "2023-02-28T21:26:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "rhsso-container-image: unsecured management interface exposed to adjecent network" }, { "cve": "CVE-2022-24785", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)" }, "discovery_date": "2022-04-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2072009" } ], "notes": [ { "category": "description", "text": "A path traversal vulnerability was found in Moment.js that impacts npm (server) users. This issue occurs if a user-provided locale string is directly used to switch moment locale, which an attacker can exploit to change the correct path to one of their choice. This can result in a loss of integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "Moment.js: Path traversal in moment.locale", "title": "Vulnerability summary" }, { "category": "other", "text": "In Quay 3.10 and above, no version of affected momentjs is present.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-24785" }, { "category": "external", "summary": "RHBZ#2072009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2072009" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-24785", "url": "https://www.cve.org/CVERecord?id=CVE-2022-24785" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-24785" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4", "url": "https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4" } ], "release_date": "2022-04-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" }, { "category": "workaround", "details": "Sanitize the user-provided locale name before passing it to Moment.js.", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Moment.js: Path traversal in moment.locale" }, { "cve": "CVE-2022-25857", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-09-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2126789" } ], "notes": [ { "category": "description", "text": "A flaw was found in the org.yaml.snakeyaml package. This flaw allows an attacker to cause a denial of service (DoS) due to missing nested depth limitation for collections.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Denial of Service due to missing nested depth limitation for collections", "title": "Vulnerability summary" }, { "category": "other", "text": "For RHEL-8 it\u0027s downgraded to moderate because \"snakeyaml\" itself in RHEL 8 or RHEL-9 isn\u0027t shipped and \"prometheus-jmx-exporter\" is needed as build dependency. And it\u0027s not directly exploitable, hence severity marked as moderate.\nRed Hat Integration and AMQ products are not vulnerable to this flaw, so their severity has been lowered to moderate.\nRed Hat Single Sign-On uses snakeyaml from liquibase-core and is only used when performing migrations and would require administrator privileges to execute, hence severity marked as Low.\nRed Hat Fuse 7 is now in Maintenance Support Phase and details about its fix should be present soon. However, Red Hat Fuse Online (Syndesis) does will not contain the fix for this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25857" }, { "category": "external", "summary": "RHBZ#2126789", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2126789" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25857", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25857" }, { "category": "external", "summary": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525", "url": "https://bitbucket.org/snakeyaml/snakeyaml/issues/525" } ], "release_date": "2022-08-30T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "snakeyaml: Denial of Service due to missing nested depth limitation for collections" }, { "cve": "CVE-2022-31129", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-07-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2105075" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Moment.js package. Users who pass user-provided strings without sanity length checks to the moment constructor are vulnerable to regular expression denial of service (ReDoS) attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "moment: inefficient parsing algorithm resulting in DoS", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Fuse provides the affected software but does not use the functionality and as such its impact has been downgraded to Low.\n\nRed Hat Advanced Cluster Management for Kubernetes (RHACM) ships a vulnerable version of the moment library. However, this affected functionality is restricted behind OAuth, reducing the impact to Moderate.\n\nRed Hat Satellite ships a vulnerable version of the moment library. However, this only affects a specific component (qpid-dispatch), reducing the impact to Moderate.\n\nRed Hat Ceph Storage (RHCS) ships a vulnerable version of the moment library, however, it is not directly used and is a transitive dependency from Angular. In addition, the impact would only be to the grafana browser, and not the underlying RHCS system, which reduces the impact to Moderate. \n\nRed Hat OpenShift Service Mesh (OSSM) ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nRed Hat OpenShift distributed tracing ships a vulnerable version of the moment library, however, it is not directly used, and as such, the impact has been lowered to Moderate.\n\nIn Logging Subsystem for Red Hat OpenShift the vulnerable moment nodejs package is bundled in the ose-logging-kibana6 container as a transitive dependency, hence the direct impact is reduced to Moderate.\n\nIn OpenShift Container Platform 4 the vulnerabile moment package is a third party dependency, hence the direct impact is reduced to Moderate.\n\nIn Quay IO 3.10 and above, no version of affected momentjs is present.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-31129" }, { "category": "external", "summary": "RHBZ#2105075", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2105075" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-31129", "url": "https://www.cve.org/CVERecord?id=CVE-2022-31129" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31129" }, { "category": "external", "summary": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g", "url": "https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g" } ], "release_date": "2022-07-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "moment: inefficient parsing algorithm resulting in DoS" }, { "cve": "CVE-2022-37603", "cwe": { "id": "CWE-185", "name": "Incorrect Regular Expression" }, "discovery_date": "2022-11-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2140597" } ], "notes": [ { "category": "description", "text": "A flaw was found in loader-utils webpack library. When the url variable from interpolateName is set, the prototype can be polluted. This issue could lead to a regular expression Denial of Service (ReDoS), affecting the availability of the affected component.", "title": "Vulnerability description" }, { "category": "summary", "text": "loader-utils: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-37603" }, { "category": "external", "summary": "RHBZ#2140597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2140597" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-37603", "url": "https://www.cve.org/CVERecord?id=CVE-2022-37603" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-37603" } ], "release_date": "2022-10-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "loader-utils: Regular expression denial of service" }, { "cve": "CVE-2022-38749", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129706" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash, resulting in a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38749" }, { "category": "external", "summary": "RHBZ#2129706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129706" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38749", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38749" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38749" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.composer.Composer.composeSequenceNode" }, { "cve": "CVE-2022-38750", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129707" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38750" }, { "category": "external", "summary": "RHBZ#2129707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129707" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38750", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38750" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38750" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in org.yaml.snakeyaml.constructor.BaseConstructor.constructObject" }, { "cve": "CVE-2022-38751", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-09-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2129709" } ], "notes": [ { "category": "description", "text": "A flaw was found in the snakeyaml package due to a stack-overflow in parsing YAML files. By persuading a victim to open a specially-crafted file, a remote attacker could cause the application to crash.", "title": "Vulnerability description" }, { "category": "summary", "text": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Build of Quarkus is not affected by this issue as it already includes the fixed version.\n\nSatellite component Candlepin does not directly use snakeyaml, so it is not affected. Regardless, an update with the latest, unaffected snakeyaml version will be provided at next release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-38751" }, { "category": "external", "summary": "RHBZ#2129709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2129709" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-38751", "url": "https://www.cve.org/CVERecord?id=CVE-2022-38751" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-38751" } ], "release_date": "2022-09-05T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "snakeyaml: Uncaught exception in java.base/java.util.regex.Pattern$Ques.match" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46175", "cwe": { "id": "CWE-1321", "name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)" }, "discovery_date": "2022-12-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2156263" } ], "notes": [ { "category": "description", "text": "A flaw was found in the json5 package. The affected version of the json5 package could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse.", "title": "Vulnerability description" }, { "category": "summary", "text": "json5: Prototype Pollution in JSON5 via Parse Method", "title": "Vulnerability summary" }, { "category": "other", "text": "The json5 package is a build-time dependency in Red Hat products and is not used in production runtime. Hence, the impact is set to Moderate.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46175" }, { "category": "external", "summary": "RHBZ#2156263", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2156263" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46175", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46175" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46175" }, { "category": "external", "summary": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h", "url": "https://github.com/json5/json5/security/advisories/GHSA-9c47-m6qq-7p4h" } ], "release_date": "2022-12-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "json5: Prototype Pollution in JSON5 via Parse Method" }, { "cve": "CVE-2022-46363", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155681" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Apache CXF that could allow an attacker to perform a remote directory listing or code exfiltration. This issue only applies when the CXFServlet is configured with both the static-resources-list and redirect-query-check attributes. These attributes are not supposed to be used together, so the issue can only occur if the CXF service is misconfigured.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: directory listing / code exfiltration", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46363" }, { "category": "external", "summary": "RHBZ#2155681", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155681" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46363", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46363" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46363" }, { "category": "external", "summary": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c", "url": "https://lists.apache.org/thread/pdzo1qgyplf4y523tnnzrcm7hoco3l8c" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "CXF: directory listing / code exfiltration" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "CXF: SSRF Vulnerability" }, { "acknowledgments": [ { "names": [ "Sourav Kumar" ], "organization": "https://github.com/souravs17031999", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0091", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2022-10-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2158585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where it did not properly check client tokens for possible revocation in its client credential flow. This flaw allows an attacker to access or modify potentially sensitive information.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Client Registration endpoint does not check token revocation", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0091" }, { "category": "external", "summary": "RHBZ#2158585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2158585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0091", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0091" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0091" }, { "category": "external", "summary": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg", "url": "https://github.com/keycloak/keycloak/security/advisories/GHSA-v436-q368-hvgg" }, { "category": "external", "summary": "https://github.com/keycloak/security/issues/27", "url": "https://github.com/keycloak/security/issues/27" } ], "release_date": "2022-10-28T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: Client Registration endpoint does not check token revocation" }, { "acknowledgments": [ { "names": [ "Jordi Zayuelas i Mu\u00f1oz" ], "organization": "A1 Digital", "summary": "Acknowledged by upstream." } ], "cve": "CVE-2023-0264", "cwe": { "id": "CWE-303", "name": "Incorrect Implementation of Authentication Algorithm" }, "discovery_date": "2023-01-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2160585" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s OpenID Connect user authentication, which may incorrectly authenticate requests. An authenticated attacker who could obtain information from a user request within the same realm could use that data to impersonate the victim and generate new session tokens. This issue could impact confidentiality, Integrity, and availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: user impersonation via stolen uuid code", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2023-0264" }, { "category": "external", "summary": "RHBZ#2160585", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2160585" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2023-0264", "url": "https://www.cve.org/CVERecord?id=CVE-2023-0264" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-0264" } ], "release_date": "2023-02-28T18:58:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-03-01T21:46:46+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:1047" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "LOW", "baseScore": 4.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:10450cf7e28d9b1628e95867562763019181a9a980e6e465fe69faf056a1cb60_ppc64le", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:19520720c6ff7acbfb4c8b1bc0d9353c2205bb640405f1d08f70ee14061f190f_amd64", "8Base-RHOSE-Middleware:rh-sso-7/sso76-openshift-rhel8@sha256:77e19865fa9031305daa8c9872eb273c6442748a9cd3d6628309721fbf781c21_s390x" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: user impersonation via stolen uuid code" } ] }
rhsa-2020_4847
Vulnerability from csaf_redhat
Published
2020-11-04 01:39
Modified
2024-11-22 15:10
Summary
Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
Notes
Topic
An update for the pki-core:10.6 and pki-deps:10.6 modules is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.
Security Fix(es):
* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)
* bootstrap: XSS in the data-target attribute (CVE-2016-10735)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)
* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)
* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)
* jquery: Prototype pollution in object's prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jquery: Passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* pki: Dogtag's python client does not validate certificates (CVE-2020-15720)
* pki-core: Reflected XSS in 'path length' constraint field in CA's Agent page (CVE-2019-10146)
* pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA's DRM agent page in authorize recovery tab (CVE-2019-10179)
* pki-core: Reflected XSS in getcookies?url= endpoint in CA (CVE-2019-10221)
* pki-core: KRA vulnerable to reflected XSS via the getPk12 page (CVE-2020-1721)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update for the pki-core:10.6 and pki-deps:10.6 modules is now available for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.\n\nSecurity Fix(es):\n\n* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)\n\n* bootstrap: XSS in the data-target attribute (CVE-2016-10735)\n\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute (CVE-2018-14040)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip (CVE-2018-14042)\n\n* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)\n\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection (CVE-2019-11358)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* jquery: Passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n\n* pki: Dogtag\u0027s python client does not validate certificates (CVE-2020-15720)\n\n* pki-core: Reflected XSS in \u0027path length\u0027 constraint field in CA\u0027s Agent page (CVE-2019-10146)\n\n* pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA\u0027s DRM agent page in authorize recovery tab (CVE-2019-10179)\n\n* pki-core: Reflected XSS in getcookies?url= endpoint in CA (CVE-2019-10221)\n\n* pki-core: KRA vulnerable to reflected XSS via the getPk12 page (CVE-2020-1721)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nFor detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes linked from the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:4847", "url": "https://access.redhat.com/errata/RHSA-2020:4847" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/", "url": "https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.3_release_notes/" }, { "category": "external", "summary": "1376706", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1376706" }, { "category": "external", "summary": "1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "1406505", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1406505" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1666907", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666907" }, { "category": "external", "summary": "1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "1695901", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695901" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1706521", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1706521" }, { "category": "external", "summary": "1710171", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1710171" }, { "category": "external", "summary": "1721684", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1721684" }, { "category": "external", "summary": "1724433", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1724433" }, { "category": "external", "summary": "1732565", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1732565" }, { "category": "external", "summary": "1732981", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1732981" }, { "category": "external", "summary": "1777579", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1777579" }, { "category": "external", "summary": "1805541", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805541" }, { "category": "external", "summary": "1817247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1817247" }, { "category": "external", "summary": "1821851", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821851" }, { "category": "external", "summary": "1822246", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1822246" }, { "category": "external", "summary": "1824939", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1824939" }, { "category": "external", "summary": "1824948", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1824948" }, { "category": "external", "summary": "1825998", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1825998" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1842734", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1842734" }, { "category": "external", "summary": "1842736", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1842736" }, { "category": "external", "summary": "1843537", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843537" }, { "category": "external", "summary": "1845447", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845447" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "1854043", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1854043" }, { "category": "external", "summary": "1854959", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1854959" }, { "category": "external", "summary": "1855273", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1855273" }, { "category": "external", "summary": "1855319", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1855319" }, { "category": "external", "summary": "1856368", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1856368" }, { "category": "external", "summary": "1857933", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1857933" }, { "category": "external", "summary": "1861911", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1861911" }, { "category": "external", "summary": "1869893", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1869893" }, { "category": "external", "summary": "1871064", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1871064" }, { "category": "external", "summary": "1873235", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1873235" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_4847.json" } ], "title": "Red Hat Security Advisory: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2024-11-22T15:10:07+00:00", "generator": { "date": "2024-11-22T15:10:07+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:4847", "initial_release_date": "2020-11-04T01:39:43+00:00", "revision_history": [ { "date": "2020-11-04T01:39:43+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-11-04T01:39:43+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-22T15:10:07+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product": { "name": "Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA", "product_identification_helper": { "cpe": "cpe:/a:redhat:enterprise_linux:8::appstream" } } } ], "category": "product_family", "name": "Red Hat Enterprise Linux" }, { "branches": [ { "category": "product_version", "name": "pki-deps:10.6:8030020200527165326:30b713e6", "product": { "name": "pki-deps:10.6:8030020200527165326:30b713e6", "product_id": "pki-deps:10.6:8030020200527165326:30b713e6", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/pki-deps@10.6:8030020200527165326:30b713e6" } } }, { "category": "product_version", "name": "apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-collections@3.2.2-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-lang@2.6-21.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "product": { "name": "apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "product_id": "apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-net@3.6-3.module%2Bel8.3.0%2B6805%2B72837426?arch=noarch" } } }, { "category": "product_version", "name": "bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/bea-stax-api@1.2.0-16.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/glassfish-fastinfoset@1.2.13-9.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/glassfish-jaxb-api@2.2.12-8.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/glassfish-jaxb-core@2.2.11-11.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/glassfish-jaxb-runtime@2.2.11-11.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/glassfish-jaxb-txw2@2.2.11-11.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "product": { "name": "jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "product_id": "jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-annotations@2.10.0-1.module%2Bel8.2.0%2B5059%2B3eb3af25?arch=noarch" } } }, { "category": "product_version", "name": "jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "product": { "name": "jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "product_id": "jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-core@2.10.0-1.module%2Bel8.2.0%2B5059%2B3eb3af25?arch=noarch" } } }, { "category": "product_version", "name": "jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "product": { "name": "jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "product_id": "jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-databind@2.10.0-1.module%2Bel8.2.0%2B5059%2B3eb3af25?arch=noarch" } } }, { "category": "product_version", "name": "jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "product": { "name": "jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "product_id": "jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-jaxrs-json-provider@2.9.9-1.module%2Bel8.1.0%2B3832%2B9784644d?arch=noarch" } } }, { "category": "product_version", "name": "jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "product": { "name": "jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "product_id": "jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-jaxrs-providers@2.9.9-1.module%2Bel8.1.0%2B3832%2B9784644d?arch=noarch" } } }, { "category": "product_version", "name": "jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-module-jaxb-annotations@2.7.6-4.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-28.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/javassist@3.18.1-8.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/javassist-javadoc@3.18.1-8.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "product": { "name": "pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "product_id": "pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-servlet-4.0-api@9.0.30-1.module%2Bel8.3.0%2B6730%2B8f9c6254?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "product": { "name": "pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "product_id": "pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-servlet-engine@9.0.30-1.module%2Bel8.3.0%2B6730%2B8f9c6254?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/relaxngDatatype@2011.1-7.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "product": { "name": "resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "product_id": "resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/resteasy@3.0.26-3.module%2Bel8.2.0%2B5723%2B4574fbff?arch=noarch" } } }, { "category": "product_version", "name": "slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j@1.7.25-4.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j-jdk14@1.7.25-4.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "product": { "name": "stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "product_id": "stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/stax-ex@1.7.7-8.module%2Bel8.2.0%2B5723%2B4574fbff?arch=noarch" } } }, { "category": "product_version", "name": "velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/velocity@1.7-24.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/xalan-j2@2.7.1-38.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/xerces-j2@2.11.0-34.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/xml-commons-apis@1.4.01-25.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/xml-commons-resolver@1.2-26.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "product": { "name": "xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "product_id": "xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/xmlstreambuffer@1.5.4-8.module%2Bel8.2.0%2B5723%2B4574fbff?arch=noarch" } } }, { "category": "product_version", "name": "xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "product": { "name": "xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "product_id": "xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/xsom@0-19.20110809svn.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=noarch" } } }, { "category": "product_version", "name": "pki-core:10.6:8030020200911215836:5ff1562f", "product": { "name": "pki-core:10.6:8030020200911215836:5ff1562f", "product_id": "pki-core:10.6:8030020200911215836:5ff1562f", "product_identification_helper": { "purl": "pkg:rpmmod/redhat/pki-core@10.6:8030020200911215836:5ff1562f" } } }, { "category": "product_version", "name": "ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "product": { "name": "ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "product_id": "ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ldapjdk@4.22.0-1.module%2Bel8.3.0%2B6784%2B6e1e4c62?arch=noarch" } } }, { "category": "product_version", "name": "ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "product": { "name": "ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "product_id": "ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ldapjdk-javadoc@4.22.0-1.module%2Bel8.3.0%2B6784%2B6e1e4c62?arch=noarch" } } }, { "category": "product_version", "name": "pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product": { "name": "pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_id": "pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-base@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=noarch" } } }, { "category": "product_version", "name": "pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product": { "name": "pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_id": "pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-base-java@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=noarch" } } }, { "category": "product_version", "name": "pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product": { "name": "pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_id": "pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-ca@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=noarch" } } }, { "category": "product_version", "name": "pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product": { "name": "pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_id": "pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-kra@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=noarch" } } }, { "category": "product_version", "name": "pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product": { "name": "pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_id": "pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-server@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=noarch" } } }, { "category": "product_version", "name": "python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product": { "name": "python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_id": "python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-pki@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=noarch" } } }, { "category": "product_version", "name": "tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "product": { "name": "tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "product_id": "tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcatjss@7.5.0-1.module%2Bel8.3.0%2B7355%2Bc59bcbd9?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "product_id": "apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-collections@3.2.2-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "product_id": "apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-lang@2.6-21.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "product": { "name": "apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "product_id": "apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-net@3.6-3.module%2Bel8.3.0%2B6805%2B72837426?arch=src" } } }, { "category": "product_version", "name": "bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "product_id": "bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/bea-stax@1.2.0-16.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "product_id": "glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/glassfish-fastinfoset@1.2.13-9.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "product_id": "glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/glassfish-jaxb@2.2.11-11.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "product_id": "glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/glassfish-jaxb-api@2.2.12-8.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "product": { "name": "jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "product_id": "jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-annotations@2.10.0-1.module%2Bel8.2.0%2B5059%2B3eb3af25?arch=src" } } }, { "category": "product_version", "name": "jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "product": { "name": "jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "product_id": "jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-core@2.10.0-1.module%2Bel8.2.0%2B5059%2B3eb3af25?arch=src" } } }, { "category": "product_version", "name": "jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "product": { "name": "jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "product_id": "jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-databind@2.10.0-1.module%2Bel8.2.0%2B5059%2B3eb3af25?arch=src" } } }, { "category": "product_version", "name": "jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "product": { "name": "jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "product_id": "jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-jaxrs-providers@2.9.9-1.module%2Bel8.1.0%2B3832%2B9784644d?arch=src" } } }, { "category": "product_version", "name": "jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "product_id": "jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jackson-module-jaxb-annotations@2.7.6-4.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "product_id": "jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jakarta-commons-httpclient@3.1-28.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "product_id": "javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/javassist@3.18.1-8.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "product": { "name": "pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "product_id": "pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-servlet-engine@9.0.30-1.module%2Bel8.3.0%2B6730%2B8f9c6254?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "product_id": "python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-nss@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "product_id": "relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/relaxngDatatype@2011.1-7.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "product": { "name": "resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "product_id": "resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/resteasy@3.0.26-3.module%2Bel8.2.0%2B5723%2B4574fbff?arch=src" } } }, { "category": "product_version", "name": "slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "product_id": "slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/slf4j@1.7.25-4.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "product": { "name": "stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "product_id": "stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/stax-ex@1.7.7-8.module%2Bel8.2.0%2B5723%2B4574fbff?arch=src" } } }, { "category": "product_version", "name": "velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "product_id": "velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/velocity@1.7-24.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "product_id": "xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/xalan-j2@2.7.1-38.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "product_id": "xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/xerces-j2@2.11.0-34.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "product_id": "xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/xml-commons-apis@1.4.01-25.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "product_id": "xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/xml-commons-resolver@1.2-26.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "product": { "name": "xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "product_id": "xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/xmlstreambuffer@1.5.4-8.module%2Bel8.2.0%2B5723%2B4574fbff?arch=src" } } }, { "category": "product_version", "name": "xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src", "product": { "name": "xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src", "product_id": "xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/xsom@0-19.20110809svn.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=src" } } }, { "category": "product_version", "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "product": { "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "product_id": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=src" } } }, { "category": "product_version", "name": "ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "product": { "name": "ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "product_id": "ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ldapjdk@4.22.0-1.module%2Bel8.3.0%2B6784%2B6e1e4c62?arch=src" } } }, { "category": "product_version", "name": "pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "product": { "name": "pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "product_id": "pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-core@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=src" } } }, { "category": "product_version", "name": "tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "product": { "name": "tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "product_id": "tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/tomcatjss@7.5.0-1.module%2Bel8.3.0%2B7355%2Bc59bcbd9?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product": { "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product_id": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-nss-debugsource@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=x86_64" } } }, { "category": "product_version", "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product": { "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product_id": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-nss-doc@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=x86_64" } } }, { "category": "product_version", "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product": { "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product_id": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-nss@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=x86_64" } } }, { "category": "product_version", "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product": { "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product_id": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-nss-debuginfo@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=x86_64" } } }, { "category": "product_version", "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product": { "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_id": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=x86_64" } } }, { "category": "product_version", "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product": { "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_id": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-debuginfo@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=x86_64" } } }, { "category": "product_version", "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product": { "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_id": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-debugsource@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=x86_64" } } }, { "category": "product_version", "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product": { "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_id": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-javadoc@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=x86_64" } } }, { "category": "product_version", "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product": { "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_id": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-core-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=x86_64" } } }, { "category": "product_version", "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product": { "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_id": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-core-debugsource@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=x86_64" } } }, { "category": "product_version", "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product": { "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_id": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-symkey@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=x86_64" } } }, { "category": "product_version", "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product": { "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_id": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-symkey-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=x86_64" } } }, { "category": "product_version", "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product": { "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_id": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-tools@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=x86_64" } } }, { "category": "product_version", "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product": { "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_id": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-tools-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product": { "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product_id": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-nss-debugsource@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=s390x" } } }, { "category": "product_version", "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product": { "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product_id": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-nss-doc@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=s390x" } } }, { "category": "product_version", "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product": { "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product_id": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-nss@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=s390x" } } }, { "category": "product_version", "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product": { "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product_id": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-nss-debuginfo@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=s390x" } } }, { "category": "product_version", "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product": { "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product_id": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=s390x" } } }, { "category": "product_version", "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product": { "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product_id": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-debuginfo@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=s390x" } } }, { "category": "product_version", "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product": { "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product_id": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-debugsource@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=s390x" } } }, { "category": "product_version", "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product": { "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product_id": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-javadoc@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=s390x" } } }, { "category": "product_version", "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product": { "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_id": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-core-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=s390x" } } }, { "category": "product_version", "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product": { "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_id": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-core-debugsource@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=s390x" } } }, { "category": "product_version", "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product": { "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_id": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-symkey@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=s390x" } } }, { "category": "product_version", "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product": { "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_id": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-symkey-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=s390x" } } }, { "category": "product_version", "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product": { "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_id": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-tools@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=s390x" } } }, { "category": "product_version", "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product": { "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_id": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-tools-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=s390x" } } } ], "category": "architecture", "name": "s390x" }, { "branches": [ { "category": "product_version", "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product": { "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product_id": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-nss-debugsource@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=ppc64le" } } }, { "category": "product_version", "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product": { "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product_id": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-nss-doc@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=ppc64le" } } }, { "category": "product_version", "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product": { "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product_id": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-nss@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=ppc64le" } } }, { "category": "product_version", "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product": { "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product_id": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-nss-debuginfo@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=ppc64le" } } }, { "category": "product_version", "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product": { "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_id": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=ppc64le" } } }, { "category": "product_version", "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product": { "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_id": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-debuginfo@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=ppc64le" } } }, { "category": "product_version", "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product": { "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_id": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-debugsource@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=ppc64le" } } }, { "category": "product_version", "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product": { "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_id": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-javadoc@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=ppc64le" } } }, { "category": "product_version", "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product": { "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_id": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-core-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=ppc64le" } } }, { "category": "product_version", "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product": { "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_id": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-core-debugsource@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=ppc64le" } } }, { "category": "product_version", "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product": { "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_id": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-symkey@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=ppc64le" } } }, { "category": "product_version", "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product": { "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_id": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-symkey-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=ppc64le" } } }, { "category": "product_version", "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product": { "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_id": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-tools@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=ppc64le" } } }, { "category": "product_version", "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product": { "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_id": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-tools-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product": { "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product_id": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-nss-debugsource@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=aarch64" } } }, { "category": "product_version", "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product": { "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product_id": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-nss-doc@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=aarch64" } } }, { "category": "product_version", "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product": { "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product_id": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-nss@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=aarch64" } } }, { "category": "product_version", "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product": { "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product_id": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-nss-debuginfo@1.0.1-10.module%2Bel8.1.0%2B3366%2B6dfb954c?arch=aarch64" } } }, { "category": "product_version", "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product": { "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_id": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=aarch64" } } }, { "category": "product_version", "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product": { "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_id": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-debuginfo@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=aarch64" } } }, { "category": "product_version", "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product": { "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_id": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-debugsource@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=aarch64" } } }, { "category": "product_version", "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product": { "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_id": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/jss-javadoc@4.7.3-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=aarch64" } } }, { "category": "product_version", "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product": { "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_id": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-core-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=aarch64" } } }, { "category": "product_version", "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product": { "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_id": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-core-debugsource@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=aarch64" } } }, { "category": "product_version", "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product": { "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_id": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-symkey@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=aarch64" } } }, { "category": "product_version", "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product": { "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_id": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-symkey-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=aarch64" } } }, { "category": "product_version", "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product": { "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_id": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-tools@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=aarch64" } } }, { "category": "product_version", "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product": { "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_id": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "product_identification_helper": { "purl": "pkg:rpm/redhat/pki-tools-debuginfo@10.9.4-1.module%2Bel8.3.0%2B8058%2Bd5cd4219?arch=aarch64" } } } ], "category": "architecture", "name": "aarch64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, "product_reference": "pki-core:10.6:8030020200911215836:5ff1562f", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64" }, "product_reference": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le" }, "product_reference": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x" }, "product_reference": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src" }, "product_reference": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64" }, "product_reference": "jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64" }, "product_reference": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le" }, "product_reference": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x" }, "product_reference": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64" }, "product_reference": "jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64" }, "product_reference": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le" }, "product_reference": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x" }, "product_reference": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64" }, "product_reference": "jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64" }, "product_reference": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le" }, "product_reference": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x" }, "product_reference": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64" }, "product_reference": "jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch" }, "product_reference": "ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src" }, "product_reference": "ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch" }, "product_reference": "ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch" }, "product_reference": "pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch" }, "product_reference": "pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch" }, "product_reference": "pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src" }, "product_reference": "pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64" }, "product_reference": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le" }, "product_reference": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x" }, "product_reference": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64" }, "product_reference": "pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64" }, "product_reference": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le" }, "product_reference": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x" }, "product_reference": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64" }, "product_reference": "pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch" }, "product_reference": "pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch" }, "product_reference": "pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64" }, "product_reference": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le" }, "product_reference": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x" }, "product_reference": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64" }, "product_reference": "pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64" }, "product_reference": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le" }, "product_reference": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x" }, "product_reference": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64" }, "product_reference": "pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64" }, "product_reference": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le" }, "product_reference": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x" }, "product_reference": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64" }, "product_reference": "pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64" }, "product_reference": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le" }, "product_reference": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x" }, "product_reference": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64 as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64" }, "product_reference": "pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch" }, "product_reference": "python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch" }, "product_reference": "tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src as a component of pki-core:10.6:8030020200911215836:5ff1562f as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src" }, "product_reference": "tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f" }, { "category": "default_component_of", "full_product_name": { "name": "pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, "product_reference": "pki-deps:10.6:8030020200527165326:30b713e6", "relates_to_product_reference": "AppStream-8.3.0.GA" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch" }, "product_reference": "apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src" }, "product_reference": "apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch" }, "product_reference": "jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src" }, "product_reference": "jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch" }, "product_reference": "jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src" }, "product_reference": "jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch" }, "product_reference": "jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src" }, "product_reference": "jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch" }, "product_reference": "jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch" }, "product_reference": "jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src" }, "product_reference": "jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch" }, "product_reference": "pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch" }, "product_reference": "pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src" }, "product_reference": "pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64 as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64" }, "product_reference": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le" }, "product_reference": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x" }, "product_reference": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64 as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64" }, "product_reference": "python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64 as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64" }, "product_reference": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le" }, "product_reference": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x" }, "product_reference": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64 as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64" }, "product_reference": "python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64 as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64" }, "product_reference": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le" }, "product_reference": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x" }, "product_reference": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64 as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64" }, "product_reference": "python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64 as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64" }, "product_reference": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le" }, "product_reference": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x" }, "product_reference": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64 as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64" }, "product_reference": "python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch" }, "product_reference": "resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src" }, "product_reference": "resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch" }, "product_reference": "stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src" }, "product_reference": "stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch" }, "product_reference": "xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src" }, "product_reference": "xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch" }, "product_reference": "xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" }, { "category": "default_component_of", "full_product_name": { "name": "xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src as a component of pki-deps:10.6:8030020200527165326:30b713e6 as a component of Red Hat Enterprise Linux AppStream (v. 8)", "product_id": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" }, "product_reference": "xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src", "relates_to_product_reference": "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-9251", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2016-11-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1399546" } ], "notes": [ { "category": "description", "text": "jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting via cross-domain ajax requests", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-9251" }, { "category": "external", "summary": "RHBZ#1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-9251", "url": "https://www.cve.org/CVERecord?id=CVE-2015-9251" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-9251", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9251" } ], "release_date": "2015-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting via cross-domain ajax requests" }, { "cve": "CVE-2016-10735", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-01-09T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668097" } ], "notes": [ { "category": "description", "text": "In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the data-target attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.\n\nRed Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-10735" }, { "category": "external", "summary": "RHBZ#1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-10735", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735" } ], "release_date": "2016-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: XSS in the data-target attribute" }, { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-8331", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-02-20T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1686454" } ], "notes": [ { "category": "description", "text": "A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the tooltip or popover data-template attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-8331" }, { "category": "external", "summary": "RHBZ#1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-8331", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8331" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331" } ], "release_date": "2019-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: XSS in the tooltip or popover data-template attribute" }, { "acknowledgments": [ { "names": [ "Pritam Singh" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2019-10146", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-05-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1710171" } ], "notes": [ { "category": "description", "text": "A Reflected Cross Site Scripting flaw was found in the pki-ca module from the pki-core server due to the CA Agent Service not properly sanitizing the certificate request page. An attacker could inject a specially crafted value that will be executed on the victim\u0027s browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "pki-core: Reflected XSS in \u0027path length\u0027 constraint field in CA\u0027s Agent page", "title": "Vulnerability summary" }, { "category": "other", "text": "This flaw is considered Low, because it requires the attacker to first request or predict a valid nonce. Without a valid nonce, no arbitrary HTML will be sent back to the victim\u0027s browser.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10146" }, { "category": "external", "summary": "RHBZ#1710171", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1710171" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10146", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10146" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10146", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10146" } ], "release_date": "2020-02-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "pki-core: Reflected XSS in \u0027path length\u0027 constraint field in CA\u0027s Agent page" }, { "acknowledgments": [ { "names": [ "Pritam Singh" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2019-10179", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-04-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1695901" } ], "notes": [ { "category": "description", "text": "It was found that the Key Recovery Authority (KRA) Agent Service did not properly sanitize recovery request search page, enabling a Reflected Cross Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.", "title": "Vulnerability description" }, { "category": "summary", "text": "pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA\u0027s DRM agent page in authorize recovery tab", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated Low : the web UI uses client TLS authentication, therefore stealing session cookies will not be sufficient for unauthorized access. The vulnerable page itself does not contain secrets.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10179" }, { "category": "external", "summary": "RHBZ#1695901", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695901" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10179", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10179" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10179", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10179" } ], "release_date": "2020-02-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "pki-core/pki-kra: Reflected XSS in recoveryID search field at KRA\u0027s DRM agent page in authorize recovery tab" }, { "acknowledgments": [ { "names": [ "Pritam Singh" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2019-10221", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-07-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1732565" } ], "notes": [ { "category": "description", "text": "A Reflected Cross Site Scripting vulnerability was found in the pki-ca module from the pki-core server. This flaw is caused by missing sanitization of the GET URL parameters. An attacker could abuse this flaw to trick an authenticated user into clicking a specially crafted link which can execute arbitrary code when viewed in a browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "pki-core: Reflected XSS in getcookies?url= endpoint in CA", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated Low : the web UI uses client TLS authentication, therefore stealing session cookies will not be sufficient for unauthorized access. The vulnerable page itself does not contain secrets.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10221" }, { "category": "external", "summary": "RHBZ#1732565", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1732565" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10221", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10221" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10221", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10221" } ], "release_date": "2020-02-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "pki-core: Reflected XSS in getcookies?url= endpoint in CA" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "acknowledgments": [ { "names": [ "Pritam Singh" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2020-1721", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-11-27T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1777579" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Key Recovery Authority (KRA) Agent Service where it did not properly sanitize the recovery ID during a key recovery request, enabling a Reflected Cross-Site Scripting (XSS) vulnerability. An attacker could trick an authenticated victim into executing specially crafted Javascript code.", "title": "Vulnerability description" }, { "category": "summary", "text": "pki-core: KRA vulnerable to reflected XSS via the getPk12 page", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability is rated Low : the web UI uses client TLS authentication, therefore stealing session cookies will not be sufficient for unauthorized access. The vulnerable page itself does not contain secrets.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1721" }, { "category": "external", "summary": "RHBZ#1777579", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1777579" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1721", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1721" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1721", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1721" } ], "release_date": "2020-02-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "pki-core: KRA vulnerable to reflected XSS via the getPk12 page" }, { "acknowledgments": [ { "names": [ "@ZeddYu" ], "organization": "Apache Tomcat Security Team" } ], "cve": "CVE-2020-1935", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2019-12-25T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1806835" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache Tomcat. The HTTP header parsing code used an approach to end-of-line (EOL) parsing that allowed some invalid HTTP headers to be parsed as valid. This led to the possibility of HTTP Request Smuggling if Tomcat was located behind a reverse proxy that incorrectly handled the invalid Transfer-Encoding header in a particular manner. The highest threat with this vulnerability is system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling", "title": "Vulnerability summary" }, { "category": "other", "text": "OpenDaylight in Red Hat OpenStack 10 \u0026 13 was in technical preview status, because of this no fixes will be released for it.\n\nIn Red Hat Satellite 6, Candlepin is using Tomcat to provide a REST API, and has been found to be vulnerable to the flaw. However, it is currently believed that no useful attacks can be carried over.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1935" }, { "category": "external", "summary": "RHBZ#1806835", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1806835" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1935", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1935" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1935", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1935" }, { "category": "external", "summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100", "url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100" }, { "category": "external", "summary": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51", "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51" }, { "category": "external", "summary": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31", "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31" } ], "release_date": "2020-02-24T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" }, { "category": "workaround", "details": "Workaround for Red Hat Satellite 6 is to add iptables rule to deny TCP requests of Tomcat that are not originating from the Satellite.\n\nFor other Red Hat products, either mitigation isn\u0027t available or the currently available options don\u0027t meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: Mishandling of Transfer-Encoding header allows for HTTP request smuggling" }, { "cve": "CVE-2020-1938", "cwe": { "id": "CWE-285", "name": "Improper Authorization" }, "discovery_date": "2020-02-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1806398" } ], "notes": [ { "category": "description", "text": "CVE-2020-1938 is a file read/inclusion vulnerability in the AJP connector in Apache Tomcat. This is enabled by default with a default configuration port of 8009. A remote, unauthenticated attacker could exploit this vulnerability to read web application files from a vulnerable server. In instances where the vulnerable server allows file uploads, an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file types and trigger this vulnerability to gain remote code execution (RCE).", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Please refer to the Red Hat knowledgebase article: https://access.redhat.com/solutions/4851251 and CVE page https://access.redhat.com/security/cve/cve-2020-1745", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1938" }, { "category": "external", "summary": "RHBZ#1806398", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1806398" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1938", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1938" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1938" }, { "category": "external", "summary": "https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/", "url": "https://meterpreter.org/cve-2020-1938-apache-tomcat-ajp-connector-remote-code-execution-vulnerability-alert/" }, { "category": "external", "summary": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100", "url": "https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.100" }, { "category": "external", "summary": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51", "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.51" }, { "category": "external", "summary": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31", "url": "https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.31" }, { "category": "external", "summary": "https://www.cnvd.org.cn/webinfo/show/5415", "url": "https://www.cnvd.org.cn/webinfo/show/5415" }, { "category": "external", "summary": "https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487", "url": "https://www.tenable.com/blog/cve-2020-1938-ghostcat-apache-tomcat-ajp-file-readinclusion-vulnerability-cnvd-2020-10487" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-02-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" }, { "category": "workaround", "details": "Please refer to the Red Hat knowledgebase article: https://access.redhat.com/solutions/4851251", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 6.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "exploit_status", "date": "2022-03-03T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Moderate" } ], "title": "tomcat: Apache Tomcat AJP File Read/Inclusion Vulnerability" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. However, the vulnerability has not been found to be exploitable in reasonable scenarios. \n\nIn RHEL7, pcs-0.9.169-3.el7_9.3 [RHSA-2022:7343] contains an updated version of jquery (3.6.0), which does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "acknowledgments": [ { "names": [ "Christian Heimes" ] } ], "cve": "CVE-2020-15720", "cwe": { "id": "CWE-295", "name": "Improper Certificate Validation" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1855273" } ], "notes": [ { "category": "description", "text": "A flaw was found in PKI, where the dogtag\u0027s pki.client.PKIConnection class disables the python-requests certificate validation. This flaw allows an attacker to intercept a connection between a FreeIPA client and a server, and execute an active Man-in-the-Middle attack. The highest threat from this vulnerability is to confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "pki: Dogtag\u0027s python client does not validate certificates", "title": "Vulnerability summary" }, { "category": "other", "text": "In PKI, the pki.client.PKIConnection python class is used by the `pki-server` and `pkispawn` commands. `pki-server` runs locally on the server, thus not subject to a Person in the Middle attack. `pkispawn` may access remote node in decentralized or cloned contexts.\n\nIdentity Management (IPA) command line interface (the vault related sub-commands) may call pki.client.PKIConnection().", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-15720" }, { "category": "external", "summary": "RHBZ#1855273", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1855273" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-15720", "url": "https://www.cve.org/CVERecord?id=CVE-2020-15720" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-15720", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-15720" } ], "release_date": "2020-06-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "pki: Dogtag\u0027s python client does not validate certificates" }, { "cve": "CVE-2020-25715", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-10-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1891016" } ], "notes": [ { "category": "description", "text": "A flaw was found in pki-core. A specially crafted POST request can be used to reflect a DOM-based cross-site scripting (XSS) attack to inject code into the search query form which can get automatically executed. The highest threat from this vulnerability is to data integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "pki-core: XSS in the certificate search results", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux 8.3 (pki-core 10.9.4) contains mitigations that prevents the vulnerability to be exploited. Red Hat Enterprise Linux version 8 prior to 8.3 are vulnerable to this version", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-25715" }, { "category": "external", "summary": "RHBZ#1891016", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1891016" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-25715", "url": "https://www.cve.org/CVERecord?id=CVE-2020-25715" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25715", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25715" } ], "release_date": "2021-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" }, { "category": "workaround", "details": "Because the cross-site scripting (XSS) attack requires the victim to have their RHCS certificate installed in their web browser to be successful, it is recommended that web browser not hold the keys and that the user use the command line interface (CLI) instead.", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:H/A:N", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "pki-core: XSS in the certificate search results" }, { "cve": "CVE-2022-25762", "cwe": { "id": "CWE-226", "name": "Sensitive Information in Resource Not Removed Before Reuse" }, "discovery_date": "2022-05-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2085304" } ], "notes": [ { "category": "description", "text": "A flaw was found in the tomcat package. When a web application sends a WebSocket message concurrently with the WebSocket connection closing, the application may continue to use the socket after it has been closed. In this case, the error handling triggered could cause the pooled object to be placed in the pool twice. This issue results in subsequent connections using the same object concurrently, which causes data to be potentially returned to the wrong user or application stability issues.", "title": "Vulnerability description" }, { "category": "summary", "text": "tomcat: request mixup", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects Apache Tomcat 8.5.0 to 8.5.75 or Apache Tomcat 9.0.0.M1 to 9.0.20.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-25762" }, { "category": "external", "summary": "RHBZ#2085304", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2085304" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-25762", "url": "https://www.cve.org/CVERecord?id=CVE-2022-25762" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-25762", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-25762" }, { "category": "external", "summary": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.76", "url": "https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.76" } ], "release_date": "2022-05-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-11-04T01:39:43+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:4847" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L", "version": "3.1" }, "products": [ "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debuginfo-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-debugsource-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:jss-javadoc-0:4.7.3-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:ldapjdk-javadoc-0:4.22.0-1.module+el8.3.0+6784+6e1e4c62.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-base-java-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-ca-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.src", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-core-debugsource-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-kra-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-server-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-symkey-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.aarch64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.ppc64le", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.s390x", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:pki-tools-debuginfo-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.x86_64", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:python3-pki-0:10.9.4-1.module+el8.3.0+8058+d5cd4219.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.noarch", "AppStream-8.3.0.GA:pki-core:10.6:8030020200911215836:5ff1562f:tomcatjss-0:7.5.0-1.module+el8.3.0+7355+c59bcbd9.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-collections-0:3.2.2-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-lang-0:2.6-21.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:apache-commons-net-0:3.6-3.module+el8.3.0+6805+72837426.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:bea-stax-api-0:1.2.0-16.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-fastinfoset-0:1.2.13-9.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-api-0:2.2.12-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-core-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-runtime-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:glassfish-jaxb-txw2-0:2.2.11-11.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-annotations-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-core-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-databind-0:2.10.0-1.module+el8.2.0+5059+3eb3af25.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-json-provider-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-jaxrs-providers-0:2.9.9-1.module+el8.1.0+3832+9784644d.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jackson-module-jaxb-annotations-0:2.7.6-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:jakarta-commons-httpclient-1:3.1-28.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:javassist-javadoc-0:3.18.1-8.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-4.0-api-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:pki-servlet-engine-1:9.0.30-1.module+el8.3.0+6730+8f9c6254.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-debugsource-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python-nss-doc-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.aarch64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.ppc64le", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.s390x", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:python3-nss-debuginfo-0:1.0.1-10.module+el8.1.0+3366+6dfb954c.x86_64", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:relaxngDatatype-0:2011.1-7.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:resteasy-0:3.0.26-3.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:slf4j-jdk14-0:1.7.25-4.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:stax-ex-0:1.7.7-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:velocity-0:1.7-24.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xalan-j2-0:2.7.1-38.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xerces-j2-0:2.11.0-34.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-apis-0:1.4.01-25.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xml-commons-resolver-0:1.2-26.module+el8.1.0+3366+6dfb954c.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xmlstreambuffer-0:1.5.4-8.module+el8.2.0+5723+4574fbff.src", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.noarch", "AppStream-8.3.0.GA:pki-deps:10.6:8030020200527165326:30b713e6:xsom-0:0-19.20110809svn.module+el8.1.0+3366+6dfb954c.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "tomcat: request mixup" } ] }
rhsa-2020:2217
Vulnerability from csaf_redhat
Published
2020-05-28 14:58
Modified
2025-06-26 06:36
Summary
Red Hat Security Advisory: OpenShift Container Platform 3.11 security update
Notes
Topic
Red Hat OpenShift Container Platform release 3.11.219 is now available with
updates to packages and images that fix several bugs and add enhancements.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Details
Red Hat OpenShift Container Platform is Red Hat's cloud computing
Kubernetes application platform solution designed for on-premise or private
cloud deployments.
Security Fix(es):
* jquery: Cross-site scripting was present due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s)
listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat OpenShift Container Platform release 3.11.219 is now available with\nupdates to packages and images that fix several bugs and add enhancements.\n\nRed Hat Product Security has rated this update as having a security impact\nof Moderate. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat OpenShift Container Platform is Red Hat\u0027s cloud computing\nKubernetes application platform solution designed for on-premise or private\ncloud deployments.\n\nSecurity Fix(es):\n\n* jquery: Cross-site scripting was present due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s)\nlisted in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2217", "url": "https://access.redhat.com/errata/RHSA-2020:2217" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2217.json" } ], "title": "Red Hat Security Advisory: OpenShift Container Platform 3.11 security update", "tracking": { "current_release_date": "2025-06-26T06:36:03+00:00", "generator": { "date": "2025-06-26T06:36:03+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2020:2217", "initial_release_date": "2020-05-28T14:58:14+00:00", "revision_history": [ { "date": "2020-05-28T14:58:14+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-05-28T14:58:14+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-06-26T06:36:03+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Container Platform 3.11", "product": { "name": "Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:3.11::el7" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "product": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "product_id": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-web-console@3.11.219-1.git.1.9b9b889.el7?arch=ppc64le" } } } ], "category": "architecture", "name": "ppc64le" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64", "product": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64", "product_id": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-web-console@3.11.219-1.git.1.9b9b889.el7?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "product": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "product_id": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/atomic-openshift-web-console@3.11.219-1.git.1.9b9b889.el7?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le" }, "product_reference": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src" }, "product_reference": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" }, { "category": "default_component_of", "full_product_name": { "name": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64 as a component of Red Hat OpenShift Container Platform 3.11", "product_id": "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64" }, "product_reference": "atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64", "relates_to_product_reference": "7Server-RH7-RHOSE-3.11" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-05-28T14:58:14+00:00", "details": "Before applying this update, ensure all previously released errata relevant\nto your system is applied.\n\nSee the following documentation, which will be updated shortly for release\n3.11.219, for important instructions on how to upgrade your cluster and fully\napply this asynchronous errata update:\n\nhttps://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258.", "product_ids": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2217" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.ppc64le", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.src", "7Server-RH7-RHOSE-3.11:atomic-openshift-web-console-0:3.11.219-1.git.1.9b9b889.el7.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" } ] }
rhsa-2020_2813
Vulnerability from csaf_redhat
Published
2020-07-02 13:21
Modified
2024-11-21 20:07
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.4.1 security update
Notes
Topic
A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.4.1 serves as a replacement for Red Hat Single Sign-On 7.4.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: verify-token-audience support is missing in the NodeJS adapter (CVE-2020-1694)
* keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution (CVE-2020-1714)
* js-jquery: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* js-jquery: jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* undertow: invalid HTTP request with large chunk size (CVE-2020-10719)
* keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697) (CVE-2020-10748)
* jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)
* jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)
* jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)
* jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.4.1 serves as a replacement for Red Hat Single Sign-On 7.4.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: verify-token-audience support is missing in the NodeJS adapter (CVE-2020-1694)\n\n* keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution (CVE-2020-1714)\n\n* js-jquery: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* js-jquery: jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n\n* undertow: invalid HTTP request with large chunk size (CVE-2020-10719)\n\n* keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697) (CVE-2020-10748)\n\n* jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)\n\n* jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)\n\n* jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)\n\n* jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2813", "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=core.service.rhsso\u0026version=7.4", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=core.service.rhsso\u0026version=7.4" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/" }, { "category": "external", "summary": "1705975", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1705975" }, { "category": "external", "summary": "1790759", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790759" }, { "category": "external", "summary": "1816330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816330" }, { "category": "external", "summary": "1816332", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816332" }, { "category": "external", "summary": "1816337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816337" }, { "category": "external", "summary": "1816340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816340" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1828459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828459" }, { "category": "external", "summary": "1836786", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1836786" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2813.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.4.1 security update", "tracking": { "current_release_date": "2024-11-21T20:07:41+00:00", "generator": { "date": "2024-11-21T20:07:41+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.2.1" } }, "id": "RHSA-2020:2813", "initial_release_date": "2020-07-02T13:21:10+00:00", "revision_history": [ { "date": "2020-07-02T13:21:10+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-02T13:21:10+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-21T20:07:41+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.4.1", "product": { "name": "Red Hat Single Sign-On 7.4.1", "product_id": "Red Hat Single Sign-On 7.4.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_single_sign_on:7.4" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-1694", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "discovery_date": "2019-12-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1790759" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: verify-token-audience support is missing in the NodeJS adapter", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1694" }, { "category": "external", "summary": "RHBZ#1790759", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790759" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1694", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1694" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1694", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1694" } ], "release_date": "2020-07-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: verify-token-audience support is missing in the NodeJS adapter" }, { "acknowledgments": [ { "names": [ "Thomas Darimont" ] } ], "cve": "CVE-2020-1714", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-04-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1705975" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1714" }, { "category": "external", "summary": "RHBZ#1705975", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1705975" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1714", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1714" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1714", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1714" } ], "release_date": "2020-05-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "workaround", "details": "There is currently no known mitigation for this issue.", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution" }, { "cve": "CVE-2020-8840", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816330" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A \"gadget\" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8840" }, { "category": "external", "summary": "RHBZ#1816330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816330" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8840", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8840" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking" }, { "cve": "CVE-2020-9546", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816332" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in shaded-hikari-config", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-9546" }, { "category": "external", "summary": "RHBZ#1816332", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816332" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9546", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9546" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9546", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9546" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Serialization gadgets in shaded-hikari-config" }, { "cve": "CVE-2020-9547", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816337" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in ibatis-sqlmap", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-9547" }, { "category": "external", "summary": "RHBZ#1816337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816337" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9547", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9547" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Serialization gadgets in ibatis-sqlmap" }, { "cve": "CVE-2020-9548", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816340" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in anteros-core", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-9548" }, { "category": "external", "summary": "RHBZ#1816340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816340" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9548", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Serialization gadgets in anteros-core" }, { "acknowledgments": [ { "names": [ "ZeddYu" ] } ], "cve": "CVE-2020-10719", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2020-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828459" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.", "title": "Vulnerability description" }, { "category": "summary", "text": "undertow: invalid HTTP request with large chunk size", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10719" }, { "category": "external", "summary": "RHBZ#1828459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828459" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10719", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10719" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10719", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10719" } ], "release_date": "2020-05-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "undertow: invalid HTTP request with large chunk size" }, { "acknowledgments": [ { "names": [ "Lauritz Holtmann" ], "organization": "Chair for Network and Data Security at Ruhr University Bochum" } ], "cve": "CVE-2020-10748", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-05-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1836786" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s data filter, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10748" }, { "category": "external", "summary": "RHBZ#1836786", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1836786" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10748", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10748" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10748", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10748" } ], "release_date": "2020-07-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)" }, { "cve": "CVE-2020-10969", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1819212" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in javax.swing.JEditorPane", "title": "Vulnerability summary" }, { "category": "other", "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nThe PKI module as shipped in Red Hat Enterprise Linux 8 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used, lowering the impact of the vulnerability for the Product. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10969" }, { "category": "external", "summary": "RHBZ#1819212", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819212" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10969" } ], "release_date": "2020-03-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "workaround", "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jackson-databind: Serialization gadgets in javax.swing.JEditorPane" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. However, the vulnerability has not been found to be exploitable in reasonable scenarios. \n\nIn RHEL7, pcs-0.9.169-3.el7_9.3 [RHSA-2022:7343] contains an updated version of jquery (3.6.0), which does not contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" } ] }
rhsa-2020:3247
Vulnerability from csaf_redhat
Published
2020-08-04 14:02
Modified
2025-07-10 20:16
Summary
Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update
Notes
Topic
Updated ovirt-engine packages that fix several bugs and add various enhancements are now available.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The ovirt-engine package provides the Red Hat Virtualization Manager, a
centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities, resource management, live migrations, and virtual infrastructure provisioning.
The Manager is a JBoss Application Server application that provides several interfaces through which the virtual environment can be accessed and interacted with, including an Administration Portal, a VM Portal, and a Representational State Transfer (REST) Application Programming Interface (API).
A list of bugs fixed in this update is available in the Technical Notes
book:
https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes
Security Fix(es):
* apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086)
* libquartz: XXE attacks via job description (CVE-2019-13990)
* novnc: XSS vulnerability via the messages propagated to the status field (CVE-2017-18635)
* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)
* nimbus-jose-jwt: Uncaught exceptions while parsing a JWT (CVE-2019-17195)
* ovirt-engine: response_type parameter allows reflected XSS (CVE-2019-19336)
* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)
* ovirt-engine: Redirect to arbitrary URL allows for phishing (CVE-2020-10775)
* Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated ovirt-engine packages that fix several bugs and add various enhancements are now available.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The ovirt-engine package provides the Red Hat Virtualization Manager, a\ncentralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities, resource management, live migrations, and virtual infrastructure provisioning. \n\nThe Manager is a JBoss Application Server application that provides several interfaces through which the virtual environment can be accessed and interacted with, including an Administration Portal, a VM Portal, and a Representational State Transfer (REST) Application Programming Interface (API).\n\nA list of bugs fixed in this update is available in the Technical Notes\nbook:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes\n\nSecurity Fix(es):\n\n* apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086)\n\n* libquartz: XXE attacks via job description (CVE-2019-13990)\n\n* novnc: XSS vulnerability via the messages propagated to the status field (CVE-2017-18635)\n\n* bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)\n\n* nimbus-jose-jwt: Uncaught exceptions while parsing a JWT (CVE-2019-17195)\n\n* ovirt-engine: response_type parameter allows reflected XSS (CVE-2019-19336)\n\n* nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload (CVE-2020-7598)\n\n* ovirt-engine: Redirect to arbitrary URL allows for phishing (CVE-2020-10775)\n\n* Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:3247", "url": "https://access.redhat.com/errata/RHSA-2020:3247" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html-single/technical_notes", "url": "https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html-single/technical_notes" }, { "category": "external", "summary": "1080097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1080097" }, { "category": "external", "summary": "1325468", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1325468" }, { "category": "external", "summary": "1358501", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1358501" }, { "category": "external", "summary": "1427717", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1427717" }, { "category": "external", "summary": "1475774", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1475774" }, { "category": "external", "summary": "1507438", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1507438" }, { "category": "external", "summary": "1523835", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1523835" }, { "category": "external", "summary": "1527843", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1527843" }, { "category": "external", "summary": "1529042", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1529042" }, { "category": "external", "summary": "1535796", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1535796" }, { "category": "external", "summary": "1546838", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1546838" }, { "category": "external", "summary": "1547937", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1547937" }, { "category": "external", "summary": "1585986", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1585986" }, { "category": "external", "summary": "1593800", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1593800" }, { "category": "external", "summary": "1596178", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1596178" }, { "category": "external", "summary": "1600059", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1600059" }, { "category": "external", "summary": "1610212", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1610212" }, { "category": "external", "summary": "1611395", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1611395" }, { "category": "external", "summary": "1616451", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1616451" }, { "category": "external", "summary": "1637172", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1637172" }, { "category": "external", "summary": "1640908", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1640908" }, { "category": "external", "summary": "1642273", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1642273" }, { "category": "external", "summary": "1647440", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1647440" }, { "category": "external", "summary": "1648345", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1648345" }, { "category": "external", "summary": "1650417", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1650417" }, { "category": "external", "summary": "1650505", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1650505" }, { "category": "external", "summary": "1651406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1651406" }, { "category": "external", "summary": "1651939", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1651939" }, { "category": "external", "summary": "1654069", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1654069" }, { "category": "external", "summary": "1654889", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1654889" }, { "category": "external", "summary": "1656621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1656621" }, { "category": "external", "summary": "1658101", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1658101" }, { "category": "external", "summary": "1659161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1659161" }, { "category": "external", "summary": "1660071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1660071" }, { "category": "external", "summary": "1660644", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1660644" }, { "category": "external", "summary": "1663366", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1663366" }, { "category": "external", "summary": "1664479", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1664479" }, { "category": "external", "summary": "1666913", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666913" }, { "category": "external", "summary": "1670102", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1670102" }, { "category": "external", "summary": "1671876", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1671876" }, { "category": "external", "summary": "1679039", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1679039" }, { "category": "external", "summary": "1679110", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1679110" }, { "category": "external", "summary": "1679471", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1679471" }, { "category": "external", "summary": "1679730", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1679730" }, { "category": "external", "summary": "1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "1686650", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686650" }, { "category": "external", "summary": "1687345", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1687345" }, { "category": "external", "summary": "1690026", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1690026" }, { "category": "external", "summary": "1690155", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1690155" }, { "category": "external", "summary": "1690475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1690475" }, { "category": "external", "summary": "1691562", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1691562" }, { "category": "external", "summary": "1692592", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1692592" }, { "category": "external", "summary": "1693628", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693628" }, { "category": "external", "summary": "1693813", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693813" }, { "category": "external", "summary": "1695026", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695026" }, { "category": "external", "summary": "1695635", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695635" }, { "category": "external", "summary": "1696245", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696245" }, { "category": "external", "summary": "1696669", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696669" }, { "category": "external", "summary": "1696676", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696676" }, { "category": "external", "summary": "1698009", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1698009" }, { "category": "external", "summary": "1698102", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1698102" }, { "category": "external", "summary": "1700021", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1700021" }, { "category": "external", "summary": "1700036", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1700036" }, { "category": "external", "summary": "1700319", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1700319" }, { "category": "external", "summary": "1700338", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1700338" }, { "category": "external", "summary": "1700725", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1700725" }, { "category": "external", "summary": "1700867", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1700867" }, { "category": "external", "summary": "1701476", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701476" }, { "category": "external", "summary": "1701491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701491" }, { "category": "external", "summary": "1701522", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701522" }, { "category": "external", "summary": "1701528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701528" }, { "category": "external", "summary": "1701530", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701530" }, { "category": "external", "summary": "1701531", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701531" }, { "category": "external", "summary": "1701533", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701533" }, { "category": "external", "summary": "1701538", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701538" }, { "category": "external", "summary": "1701544", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701544" }, { "category": "external", "summary": "1702310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1702310" }, { "category": "external", "summary": "1702312", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1702312" }, { "category": "external", "summary": "1703112", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1703112" }, { "category": "external", "summary": "1703428", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1703428" }, { "category": "external", "summary": "1707225", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1707225" }, { "category": "external", "summary": "1708624", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1708624" }, { "category": "external", "summary": "1710491", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1710491" }, { "category": "external", "summary": "1711006", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1711006" }, { "category": "external", "summary": "1712255", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712255" }, { "category": "external", "summary": "1712746", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712746" }, { "category": "external", "summary": "1712890", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1712890" }, { "category": "external", "summary": "1714528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1714528" }, { "category": "external", "summary": "1714633", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1714633" }, { "category": "external", "summary": "1714834", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1714834" }, { "category": "external", "summary": "1715725", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1715725" }, { "category": "external", "summary": "1716590", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1716590" }, { "category": "external", "summary": "1718818", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1718818" }, { "category": "external", "summary": "1720686", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1720686" }, { "category": "external", "summary": "1720694", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1720694" }, { "category": "external", "summary": "1720795", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1720795" }, { "category": "external", "summary": "1724959", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1724959" }, { "category": "external", "summary": "1727025", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1727025" }, { "category": "external", "summary": "1728472", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1728472" }, { "category": "external", "summary": "1729511", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1729511" }, { "category": "external", "summary": "1729811", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1729811" }, { "category": "external", "summary": "1730264", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730264" }, { "category": "external", "summary": "1730436", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1730436" }, { "category": "external", "summary": "1731212", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1731212" }, { "category": "external", "summary": "1731590", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1731590" }, { "category": "external", "summary": "1733031", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1733031" }, { "category": "external", "summary": "1733529", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1733529" }, { "category": "external", "summary": "1733843", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1733843" }, { "category": "external", "summary": "1734839", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1734839" }, { "category": "external", "summary": "1737234", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1737234" }, { "category": "external", "summary": "1737684", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1737684" }, { "category": "external", "summary": "1740978", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1740978" }, { "category": "external", "summary": "1741102", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741102" }, { "category": "external", "summary": "1741271", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741271" }, { "category": "external", "summary": "1741625", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1741625" }, { "category": "external", "summary": "1743690", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1743690" }, { "category": "external", "summary": "1744557", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1744557" }, { "category": "external", "summary": "1745384", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1745384" }, { "category": "external", "summary": "1745504", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1745504" }, { "category": "external", "summary": "1746272", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1746272" }, { "category": "external", "summary": "1746430", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1746430" }, { "category": "external", "summary": "1746877", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1746877" }, { "category": "external", "summary": "1747772", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1747772" }, { "category": "external", "summary": "1749284", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749284" }, { "category": "external", "summary": "1749944", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1749944" }, { "category": "external", "summary": "1750212", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1750212" }, { "category": "external", "summary": "1750348", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1750348" }, { "category": "external", "summary": "1750357", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1750357" }, { "category": "external", "summary": "1750371", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1750371" }, { "category": "external", "summary": "1750482", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1750482" }, { "category": "external", "summary": "1751215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1751215" }, { "category": "external", "summary": "1751268", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1751268" }, { "category": "external", "summary": "1751423", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1751423" }, { "category": "external", "summary": "1752890", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752890" }, { "category": "external", "summary": "1752995", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752995" }, { "category": "external", "summary": "1753629", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1753629" }, { "category": "external", "summary": "1753661", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1753661" }, { "category": "external", "summary": "1753664", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1753664" }, { "category": "external", "summary": "1754363", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1754363" }, { "category": "external", "summary": "1754490", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1754490" }, { "category": "external", "summary": "1755412", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1755412" }, { "category": "external", "summary": "1758048", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1758048" }, { "category": "external", "summary": "1758289", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1758289" }, { "category": "external", "summary": "1762281", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1762281" }, { "category": "external", "summary": "1763992", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1763992" }, { "category": "external", "summary": "1764289", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764289" }, { "category": "external", "summary": "1764791", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764791" }, { "category": "external", "summary": "1764932", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764932" }, { "category": "external", "summary": "1764943", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764943" }, { "category": "external", "summary": "1764959", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764959" }, { "category": "external", "summary": "1765660", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1765660" }, { "category": "external", "summary": "1767319", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1767319" }, { "category": "external", "summary": "1767483", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1767483" }, { "category": "external", "summary": "1768707", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1768707" }, { "category": "external", "summary": "1768844", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1768844" }, { "category": "external", "summary": "1769463", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1769463" }, { "category": "external", "summary": "1770237", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1770237" }, { "category": "external", "summary": "1771793", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1771793" }, { "category": "external", "summary": "1773313", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1773313" }, { "category": "external", "summary": "1777954", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1777954" }, { "category": "external", "summary": "1779580", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1779580" }, { "category": "external", "summary": "1781001", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1781001" }, { "category": "external", "summary": "1782236", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1782236" }, { "category": "external", "summary": "1782279", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1782279" }, { "category": "external", "summary": "1782882", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1782882" }, { "category": "external", "summary": "1796817", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1796817" }, { "category": "external", "summary": "1797316", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1797316" }, { "category": "external", "summary": "1797500", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1797500" }, { "category": "external", "summary": "1798114", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1798114" }, { "category": "external", "summary": "1798117", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1798117" }, { "category": "external", "summary": "1798120", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1798120" }, { "category": "external", "summary": "1798127", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1798127" }, { "category": "external", "summary": "1798137", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1798137" }, { "category": "external", "summary": "1799171", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799171" }, { "category": "external", "summary": "1799204", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1799204" }, { "category": "external", "summary": "1801149", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801149" }, { "category": "external", "summary": "1801709", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801709" }, { "category": "external", "summary": "1803597", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1803597" }, { "category": "external", "summary": "1805669", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1805669" }, { "category": "external", "summary": "1806276", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1806276" }, { "category": "external", "summary": "1807047", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1807047" }, { "category": "external", "summary": "1807860", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1807860" }, { "category": "external", "summary": "1808096", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1808096" }, { "category": "external", "summary": "1808126", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1808126" }, { "category": "external", "summary": "1809040", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1809040" }, { "category": "external", "summary": "1809052", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1809052" }, { "category": "external", "summary": "1809875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1809875" }, { "category": "external", "summary": "1809877", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1809877" }, { "category": "external", "summary": "1810893", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1810893" }, { "category": "external", "summary": "1811865", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811865" }, { "category": "external", "summary": "1811869", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1811869" }, { "category": "external", "summary": "1812875", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1812875" }, { "category": "external", "summary": "1813305", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813305" }, { "category": "external", "summary": "1813344", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813344" }, { "category": "external", "summary": "1814197", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814197" }, { "category": "external", "summary": "1814215", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1814215" }, { "category": "external", "summary": "1816017", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816017" }, { "category": "external", "summary": "1816643", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816643" }, { "category": "external", "summary": "1816654", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816654" }, { "category": "external", "summary": "1816693", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816693" }, { "category": "external", "summary": "1816739", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816739" }, { "category": "external", "summary": "1817467", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1817467" }, { "category": "external", "summary": "1818745", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1818745" }, { "category": "external", "summary": "1819201", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819201" }, { "category": "external", "summary": "1819248", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819248" }, { "category": "external", "summary": "1819514", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819514" }, { "category": "external", "summary": "1819960", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819960" }, { "category": "external", "summary": "1854563", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1854563" }, { "category": "external", "summary": "1784049", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1784049" }, { "category": "external", "summary": "1784385", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1784385" }, { "category": "external", "summary": "1785750", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1785750" }, { "category": "external", "summary": "1788424", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1788424" }, { "category": "external", "summary": "1796809", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1796809" }, { "category": "external", "summary": "1796811", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1796811" }, { "category": "external", "summary": "1796815", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1796815" }, { "category": "external", "summary": "1820621", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1820621" }, { "category": "external", "summary": "1820638", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1820638" }, { "category": "external", "summary": "1821164", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821164" }, { "category": "external", "summary": "1821930", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1821930" }, { "category": "external", "summary": "1824095", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1824095" }, { "category": "external", "summary": "1825793", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1825793" }, { "category": "external", "summary": "1826248", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826248" }, { "category": "external", "summary": "1826437", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826437" }, { "category": "external", "summary": "1826801", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826801" }, { "category": "external", "summary": "1826855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1826855" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1828669", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828669" }, { "category": "external", "summary": "1828736", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828736" }, { "category": "external", "summary": "1829189", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1829189" }, { "category": "external", "summary": "1829656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1829656" }, { "category": "external", "summary": "1829830", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1829830" }, { "category": "external", "summary": "1832161", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1832161" }, { "category": "external", "summary": "1834523", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1834523" }, { "category": "external", "summary": "1838493", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1838493" }, { "category": "external", "summary": "1841495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1841495" }, { "category": "external", "summary": "1842495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1842495" }, { "category": "external", "summary": "1844270", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844270" }, { "category": "external", "summary": "1844855", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1844855" }, { "category": "external", "summary": "1845473", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1845473" }, { "category": "external", "summary": "1847420", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847420" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "1853444", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1853444" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3247.json" } ], "title": "Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update", "tracking": { "current_release_date": "2025-07-10T20:16:12+00:00", "generator": { "date": "2025-07-10T20:16:12+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2020:3247", "initial_release_date": "2020-08-04T14:02:29+00:00", "revision_history": [ { "date": "2020-08-04T14:02:29+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-08-04T14:02:29+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-10T20:16:12+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product": { "name": "RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhev_manager:4.4:el8" } } } ], "category": "product_family", "name": "Red Hat Virtualization" }, { "branches": [ { "category": "product_version", "name": "unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "product": { "name": "unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "product_id": "unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/unboundid-ldapsdk@4.0.14-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "product": { "name": "unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "product_id": "unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/unboundid-ldapsdk-javadoc@4.0.14-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ed25519-java-0:0.3.0-1.el8ev.noarch", "product": { "name": "ed25519-java-0:0.3.0-1.el8ev.noarch", "product_id": "ed25519-java-0:0.3.0-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ed25519-java@0.3.0-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "product": { "name": "ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "product_id": "ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ed25519-java-javadoc@0.3.0-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "snmp4j-0:2.4.1-1.el8ev.noarch", "product": { "name": "snmp4j-0:2.4.1-1.el8ev.noarch", "product_id": "snmp4j-0:2.4.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/snmp4j@2.4.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "product": { "name": "snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "product_id": "snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/snmp4j-javadoc@2.4.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "product": { "name": "ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "product_id": "ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ebay-cors-filter@1.0.1-4.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "product": { "name": "apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "product_id": "apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-jexl@2.1.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "product": { "name": "apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "product_id": "apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-jexl-javadoc@2.1.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-collections4-0:4.4-1.el8ev.noarch", "product": { "name": "apache-commons-collections4-0:4.4-1.el8ev.noarch", "product_id": "apache-commons-collections4-0:4.4-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-collections4@4.4-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "product": { "name": "apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "product_id": "apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-collections4-javadoc@4.4-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "product": { "name": "apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "product_id": "apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-vfs@2.4.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "product": { "name": "apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "product_id": "apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-vfs-ant@2.4.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "product": { "name": "apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "product_id": "apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-vfs-examples@2.4.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "product": { "name": "apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "product_id": "apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-vfs-javadoc@2.4.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ws-commons-util-0:1.0.2-1.el8ev.noarch", "product": { "name": "ws-commons-util-0:1.0.2-1.el8ev.noarch", "product_id": "ws-commons-util-0:1.0.2-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ws-commons-util@1.0.2-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "product": { "name": "ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "product_id": "ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ws-commons-util-javadoc@1.0.2-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "xmlrpc-client-0:3.1.3-1.el8ev.noarch", "product": { "name": "xmlrpc-client-0:3.1.3-1.el8ev.noarch", "product_id": "xmlrpc-client-0:3.1.3-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/xmlrpc-client@3.1.3-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "xmlrpc-common-0:3.1.3-1.el8ev.noarch", "product": { "name": "xmlrpc-common-0:3.1.3-1.el8ev.noarch", "product_id": "xmlrpc-common-0:3.1.3-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/xmlrpc-common@3.1.3-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "product": { "name": "xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "product_id": "xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/xmlrpc-javadoc@3.1.3-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "xmlrpc-server-0:3.1.3-1.el8ev.noarch", "product": { "name": "xmlrpc-server-0:3.1.3-1.el8ev.noarch", "product_id": "xmlrpc-server-0:3.1.3-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/xmlrpc-server@3.1.3-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "product": { "name": "ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "product_id": "ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extensions-api@1.0.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "product": { "name": "ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "product_id": "ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extensions-api-javadoc@1.0.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "product": { "name": "ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "product_id": "ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-jdbc@1.2.0-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "product": { "name": "vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "product_id": "vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/vdsm-jsonrpc-java@1.5.4-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "product": { "name": "ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "product_id": "ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-scheduler-proxy@0.1.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "makeself-0:2.4.0-4.el8ev.noarch", "product": { "name": "makeself-0:2.4.0-4.el8ev.noarch", "product_id": "makeself-0:2.4.0-4.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/makeself@2.4.0-4.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "python2-pbr-0:5.1.2-2.el8ost.noarch", "product": { "name": "python2-pbr-0:5.1.2-2.el8ost.noarch", "product_id": "python2-pbr-0:5.1.2-2.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python2-pbr@5.1.2-2.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "python3-pbr-0:5.1.2-2.el8ost.noarch", "product": { "name": "python3-pbr-0:5.1.2-2.el8ost.noarch", "product_id": "python3-pbr-0:5.1.2-2.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-pbr@5.1.2-2.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "python2-six-0:1.12.0-1.el8ost.noarch", "product": { "name": "python2-six-0:1.12.0-1.el8ost.noarch", "product_id": "python2-six-0:1.12.0-1.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python2-six@1.12.0-1.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "python3-six-0:1.12.0-1.el8ost.noarch", "product": { "name": "python3-six-0:1.12.0-1.el8ost.noarch", "product_id": "python3-six-0:1.12.0-1.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-six@1.12.0-1.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "product": { "name": "python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "product_id": "python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python2-netaddr@0.7.19-8.1.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "product": { "name": "python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "product_id": "python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-netaddr@0.7.19-8.1.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "product": { "name": "ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "product_id": "ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-api-explorer@0.0.6-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "product": { "name": "python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "product_id": "python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-ovsdbapp@0.17.1-0.20191216120142.206cf14.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "product": { "name": "rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "product_id": "rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-setup-plugins@4.4.2-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "product": { "name": "ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "product_id": "ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-ldap@1.4.0-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "product": { "name": "ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "product_id": "ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-ldap-setup@1.4.0-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "product": { "name": "ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "product_id": "ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-misc@1.1.0-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "python3-notario-0:0.0.16-2.el8cp.noarch", "product": { "name": "python3-notario-0:0.0.16-2.el8cp.noarch", "product_id": "python3-notario-0:0.0.16-2.el8cp.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-notario@0.0.16-2.el8cp?arch=noarch" } } }, { "category": "product_version", "name": "novnc-0:1.1.0-1.el8ost.noarch", "product": { "name": "novnc-0:1.1.0-1.el8ost.noarch", "product_id": "novnc-0:1.1.0-1.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/novnc@1.1.0-1.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "python3-websocket-client-0:0.54.0-1.el8ost.noarch", "product": { "name": "python3-websocket-client-0:0.54.0-1.el8ost.noarch", "product_id": "python3-websocket-client-0:0.54.0-1.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-websocket-client@0.54.0-1.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "log4j12-0:1.2.17-22.el8ev.noarch", "product": { "name": "log4j12-0:1.2.17-22.el8ev.noarch", "product_id": "log4j12-0:1.2.17-22.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/log4j12@1.2.17-22.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "product": { "name": "log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "product_id": "log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/log4j12-javadoc@1.2.17-22.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ansible-runner-0:1.4.5-1.el8ar.noarch", "product": { "name": "ansible-runner-0:1.4.5-1.el8ar.noarch", "product_id": "ansible-runner-0:1.4.5-1.el8ar.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ansible-runner@1.4.5-1.el8ar?arch=noarch" } } }, { "category": "product_version", "name": "python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "product": { "name": "python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "product_id": "python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-ansible-runner@1.4.5-1.el8ar?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "product": { "name": "ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "product_id": "ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-logger-log4j@1.1.0-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "product": { "name": "rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "product_id": "rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-dependencies@4.4.0-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "product": { "name": "java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "product_id": "java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-client-kubevirt@0.5.0-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-compress-0:1.18-1.el8ev.noarch", "product": { "name": "apache-commons-compress-0:1.18-1.el8ev.noarch", "product_id": "apache-commons-compress-0:1.18-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-compress@1.18-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "product": { "name": "apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "product_id": "apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-compress-javadoc@1.18-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-jxpath-0:1.3-29.el8ev.noarch", "product": { "name": "apache-commons-jxpath-0:1.3-29.el8ev.noarch", "product_id": "apache-commons-jxpath-0:1.3-29.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-jxpath@1.3-29.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "product": { "name": "apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "product_id": "apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-jxpath-javadoc@1.3-29.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "python3-flask-restful-0:0.3.6-8.el8ost.noarch", "product": { "name": "python3-flask-restful-0:0.3.6-8.el8ost.noarch", "product_id": "python3-flask-restful-0:0.3.6-8.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-flask-restful@0.3.6-8.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "python3-aniso8601-0:0.82-4.el8ost.noarch", "product": { "name": "python3-aniso8601-0:0.82-4.el8ost.noarch", "product_id": "python3-aniso8601-0:0.82-4.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-aniso8601@0.82-4.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "python3-werkzeug-0:0.16.0-1.el8ost.noarch", "product": { "name": "python3-werkzeug-0:0.16.0-1.el8ost.noarch", "product_id": "python3-werkzeug-0:0.16.0-1.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-werkzeug@0.16.0-1.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "product": { "name": "python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "product_id": "python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-werkzeug-doc@0.16.0-1.el8ost?arch=noarch" } } }, { "category": "product_version", "name": "python-flask-doc-1:1.0.2-2.el8ost.noarch", "product": { "name": "python-flask-doc-1:1.0.2-2.el8ost.noarch", "product_id": "python-flask-doc-1:1.0.2-2.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-flask-doc@1.0.2-2.el8ost?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "python3-flask-1:1.0.2-2.el8ost.noarch", "product": { "name": "python3-flask-1:1.0.2-2.el8ost.noarch", "product_id": "python3-flask-1:1.0.2-2.el8ost.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-flask@1.0.2-2.el8ost?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "product": { "name": "ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "product_id": "ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-cockpit-sso@0.1.4-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ansible-runner-service-0:1.0.2-1.el8ev.noarch", "product": { "name": "ansible-runner-service-0:1.0.2-1.el8ev.noarch", "product_id": "ansible-runner-service-0:1.0.2-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ansible-runner-service@1.0.2-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-ceilometer-client@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-ceilometer-model@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-cinder-client@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-cinder-model@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-client-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-client-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-client-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-client@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-glance-client@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-glance-model@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-heat-client@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-heat-model@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-javadoc@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-keystone-client@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-keystone-model@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-nova-client@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-nova-model@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-quantum-client@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-quantum-model@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-resteasy-connector@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-swift-client@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "product": { "name": "openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "product_id": "openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-swift-model@3.2.9-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "product": { "name": "ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "product_id": "ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-fast-forward-upgrade@1.1.6-0.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "engine-db-query-0:1.6.1-1.el8ev.noarch", "product": { "name": "engine-db-query-0:1.6.1-1.el8ev.noarch", "product_id": "engine-db-query-0:1.6.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/engine-db-query@1.6.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "product": { "name": "rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "product_id": "rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhv-log-collector-analyzer@1.0.2-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "product": { "name": "ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "product_id": "ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-metrics@1.4.1.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-sshd-0:2.5.1-1.el8ev.noarch", "product": { "name": "apache-sshd-0:2.5.1-1.el8ev.noarch", "product_id": "apache-sshd-0:2.5.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-sshd@2.5.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "product": { "name": "apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "product_id": "apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-sshd-javadoc@2.5.1-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "product": { "name": "rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "product_id": "rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-branding-rhv@4.4.4-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "product": { "name": "ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "product_id": "ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dwh@4.4.1.2-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "product": { "name": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "product_id": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dwh-grafana-integration-setup@4.4.1.2-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "product": { "name": "ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "product_id": "ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dwh-setup@4.4.1.2-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "product": { "name": "ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "product_id": "ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-web-ui@1.6.3-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "product": { "name": "ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "product_id": "ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-ui-extensions@1.2.2-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-backend@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dbscripts@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-health-check-bundler@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-restapi@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-base@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-cinderlib@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-imageio@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-ovirt-engine@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-ovirt-engine-common@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-vmconsole-proxy-helper@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-websocket-proxy@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-tools@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-tools-backup@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-vmconsole-proxy-helper@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-webadmin-portal@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-websocket-proxy@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-ovirt-engine-lib@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "rhvm-0:4.4.1.8-0.7.el8ev.noarch", "product": { "name": "rhvm-0:4.4.1.8-0.7.el8ev.noarch", "product_id": "rhvm-0:4.4.1.8-0.7.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm@4.4.1.8-0.7.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "product": { "name": "ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "product_id": "ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-log-collector@4.4.2-1.el8ev?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-configuration-0:1.10-1.el8ev.noarch", "product": { "name": "apache-commons-configuration-0:1.10-1.el8ev.noarch", "product_id": "apache-commons-configuration-0:1.10-1.el8ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-configuration@1.10-1.el8ev?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "product": { "name": "unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "product_id": "unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/unboundid-ldapsdk@4.0.14-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ed25519-java-0:0.3.0-1.el8ev.src", "product": { "name": "ed25519-java-0:0.3.0-1.el8ev.src", "product_id": "ed25519-java-0:0.3.0-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ed25519-java@0.3.0-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "snmp4j-0:2.4.1-1.el8ev.src", "product": { "name": "snmp4j-0:2.4.1-1.el8ev.src", "product_id": "snmp4j-0:2.4.1-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/snmp4j@2.4.1-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ebay-cors-filter-0:1.0.1-4.el8ev.src", "product": { "name": "ebay-cors-filter-0:1.0.1-4.el8ev.src", "product_id": "ebay-cors-filter-0:1.0.1-4.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ebay-cors-filter@1.0.1-4.el8ev?arch=src" } } }, { "category": "product_version", "name": "apache-commons-jexl-0:2.1.1-1.el8ev.src", "product": { "name": "apache-commons-jexl-0:2.1.1-1.el8ev.src", "product_id": "apache-commons-jexl-0:2.1.1-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-jexl@2.1.1-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "apache-commons-collections4-0:4.4-1.el8ev.src", "product": { "name": "apache-commons-collections4-0:4.4-1.el8ev.src", "product_id": "apache-commons-collections4-0:4.4-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-collections4@4.4-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "apache-commons-vfs-0:2.4.1-1.el8ev.src", "product": { "name": "apache-commons-vfs-0:2.4.1-1.el8ev.src", "product_id": "apache-commons-vfs-0:2.4.1-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-vfs@2.4.1-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ws-commons-util-0:1.0.2-1.el8ev.src", "product": { "name": "ws-commons-util-0:1.0.2-1.el8ev.src", "product_id": "ws-commons-util-0:1.0.2-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ws-commons-util@1.0.2-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "xmlrpc-0:3.1.3-1.el8ev.src", "product": { "name": "xmlrpc-0:3.1.3-1.el8ev.src", "product_id": "xmlrpc-0:3.1.3-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/xmlrpc@3.1.3-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "product": { "name": "ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "product_id": "ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extensions-api@1.0.1-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "product": { "name": "ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "product_id": "ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-jdbc@1.2.0-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "product": { "name": "vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "product_id": "vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/vdsm-jsonrpc-java@1.5.4-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "product": { "name": "ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "product_id": "ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-scheduler-proxy@0.1.9-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "makeself-0:2.4.0-4.el8ev.src", "product": { "name": "makeself-0:2.4.0-4.el8ev.src", "product_id": "makeself-0:2.4.0-4.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/makeself@2.4.0-4.el8ev?arch=src" } } }, { "category": "product_version", "name": "python-pbr-0:5.1.2-2.el8ost.src", "product": { "name": "python-pbr-0:5.1.2-2.el8ost.src", "product_id": "python-pbr-0:5.1.2-2.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-pbr@5.1.2-2.el8ost?arch=src" } } }, { "category": "product_version", "name": "python-six-0:1.12.0-1.el8ost.src", "product": { "name": "python-six-0:1.12.0-1.el8ost.src", "product_id": "python-six-0:1.12.0-1.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-six@1.12.0-1.el8ost?arch=src" } } }, { "category": "product_version", "name": "python-netaddr-0:0.7.19-8.1.el8ost.src", "product": { "name": "python-netaddr-0:0.7.19-8.1.el8ost.src", "product_id": "python-netaddr-0:0.7.19-8.1.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-netaddr@0.7.19-8.1.el8ost?arch=src" } } }, { "category": "product_version", "name": "m2crypto-0:0.35.2-5.el8ev.src", "product": { "name": "m2crypto-0:0.35.2-5.el8ev.src", "product_id": "m2crypto-0:0.35.2-5.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/m2crypto@0.35.2-5.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "product": { "name": "ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "product_id": "ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-api-explorer@0.0.6-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "product": { "name": "python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "product_id": "python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-ovsdbapp@0.17.1-0.20191216120142.206cf14.el8ost?arch=src" } } }, { "category": "product_version", "name": "rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "product": { "name": "rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "product_id": "rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-setup-plugins@4.4.2-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "product": { "name": "ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "product_id": "ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-ldap@1.4.0-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "product": { "name": "ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "product_id": "ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-misc@1.1.0-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "python-notario-0:0.0.16-2.el8cp.src", "product": { "name": "python-notario-0:0.0.16-2.el8cp.src", "product_id": "python-notario-0:0.0.16-2.el8cp.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-notario@0.0.16-2.el8cp?arch=src" } } }, { "category": "product_version", "name": "novnc-0:1.1.0-1.el8ost.src", "product": { "name": "novnc-0:1.1.0-1.el8ost.src", "product_id": "novnc-0:1.1.0-1.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/novnc@1.1.0-1.el8ost?arch=src" } } }, { "category": "product_version", "name": "python-websocket-client-0:0.54.0-1.el8ost.src", "product": { "name": "python-websocket-client-0:0.54.0-1.el8ost.src", "product_id": "python-websocket-client-0:0.54.0-1.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-websocket-client@0.54.0-1.el8ost?arch=src" } } }, { "category": "product_version", "name": "log4j12-0:1.2.17-22.el8ev.src", "product": { "name": "log4j12-0:1.2.17-22.el8ev.src", "product_id": "log4j12-0:1.2.17-22.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/log4j12@1.2.17-22.el8ev?arch=src" } } }, { "category": "product_version", "name": "ansible-runner-0:1.4.5-1.el8ar.src", "product": { "name": "ansible-runner-0:1.4.5-1.el8ar.src", "product_id": "ansible-runner-0:1.4.5-1.el8ar.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ansible-runner@1.4.5-1.el8ar?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "product": { "name": "ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "product_id": "ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-logger-log4j@1.1.0-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "rhvm-dependencies-0:4.4.0-1.el8ev.src", "product": { "name": "rhvm-dependencies-0:4.4.0-1.el8ev.src", "product_id": "rhvm-dependencies-0:4.4.0-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-dependencies@4.4.0-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "java-client-kubevirt-0:0.5.0-1.el8ev.src", "product": { "name": "java-client-kubevirt-0:0.5.0-1.el8ev.src", "product_id": "java-client-kubevirt-0:0.5.0-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/java-client-kubevirt@0.5.0-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "apache-commons-compress-0:1.18-1.el8ev.src", "product": { "name": "apache-commons-compress-0:1.18-1.el8ev.src", "product_id": "apache-commons-compress-0:1.18-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-compress@1.18-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "apache-commons-jxpath-0:1.3-29.el8ev.src", "product": { "name": "apache-commons-jxpath-0:1.3-29.el8ev.src", "product_id": "apache-commons-jxpath-0:1.3-29.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-jxpath@1.3-29.el8ev?arch=src" } } }, { "category": "product_version", "name": "python-flask-restful-0:0.3.6-8.el8ost.src", "product": { "name": "python-flask-restful-0:0.3.6-8.el8ost.src", "product_id": "python-flask-restful-0:0.3.6-8.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-flask-restful@0.3.6-8.el8ost?arch=src" } } }, { "category": "product_version", "name": "python-aniso8601-0:0.82-4.el8ost.src", "product": { "name": "python-aniso8601-0:0.82-4.el8ost.src", "product_id": "python-aniso8601-0:0.82-4.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-aniso8601@0.82-4.el8ost?arch=src" } } }, { "category": "product_version", "name": "python-werkzeug-0:0.16.0-1.el8ost.src", "product": { "name": "python-werkzeug-0:0.16.0-1.el8ost.src", "product_id": "python-werkzeug-0:0.16.0-1.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-werkzeug@0.16.0-1.el8ost?arch=src" } } }, { "category": "product_version", "name": "python-flask-1:1.0.2-2.el8ost.src", "product": { "name": "python-flask-1:1.0.2-2.el8ost.src", "product_id": "python-flask-1:1.0.2-2.el8ost.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/python-flask@1.0.2-2.el8ost?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "product": { "name": "ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "product_id": "ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-cockpit-sso@0.1.4-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ansible-runner-service-0:1.0.2-1.el8ev.src", "product": { "name": "ansible-runner-service-0:1.0.2-1.el8ev.src", "product_id": "ansible-runner-service-0:1.0.2-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ansible-runner-service@1.0.2-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "openstack-java-sdk-0:3.2.9-1.el8ev.src", "product": { "name": "openstack-java-sdk-0:3.2.9-1.el8ev.src", "product_id": "openstack-java-sdk-0:3.2.9-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/openstack-java-sdk@3.2.9-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "product": { "name": "ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "product_id": "ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-fast-forward-upgrade@1.1.6-0.el8ev?arch=src" } } }, { "category": "product_version", "name": "engine-db-query-0:1.6.1-1.el8ev.src", "product": { "name": "engine-db-query-0:1.6.1-1.el8ev.src", "product_id": "engine-db-query-0:1.6.1-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/engine-db-query@1.6.1-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "product": { "name": "rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "product_id": "rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhv-log-collector-analyzer@1.0.2-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "product": { "name": "ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "product_id": "ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-metrics@1.4.1.1-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "apache-sshd-0:2.5.1-1.el8ev.src", "product": { "name": "apache-sshd-0:2.5.1-1.el8ev.src", "product_id": "apache-sshd-0:2.5.1-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-sshd@2.5.1-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "product": { "name": "rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "product_id": "rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-branding-rhv@4.4.4-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "product": { "name": "ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "product_id": "ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dwh@4.4.1.2-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-web-ui-0:1.6.3-1.el8ev.src", "product": { "name": "ovirt-web-ui-0:1.6.3-1.el8ev.src", "product_id": "ovirt-web-ui-0:1.6.3-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-web-ui@1.6.3-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "product": { "name": "ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "product_id": "ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-ui-extensions@1.2.2-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "product": { "name": "ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "product_id": "ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine@4.4.1.8-0.7.el8ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-log-collector-0:4.4.2-1.el8ev.src", "product": { "name": "ovirt-log-collector-0:4.4.2-1.el8ev.src", "product_id": "ovirt-log-collector-0:4.4.2-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-log-collector@4.4.2-1.el8ev?arch=src" } } }, { "category": "product_version", "name": "apache-commons-configuration-0:1.10-1.el8ev.src", "product": { "name": "apache-commons-configuration-0:1.10-1.el8ev.src", "product_id": "apache-commons-configuration-0:1.10-1.el8ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-configuration@1.10-1.el8ev?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "product": { "name": "python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "product_id": "python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-m2crypto@0.35.2-5.el8ev?arch=x86_64" } } }, { "category": "product_version", "name": "m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "product": { "name": "m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "product_id": "m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/m2crypto-debugsource@0.35.2-5.el8ev?arch=x86_64" } } }, { "category": "product_version", "name": "python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "product": { "name": "python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "product_id": "python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/python3-m2crypto-debuginfo@0.35.2-5.el8ev?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ansible-runner-0:1.4.5-1.el8ar.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch" }, "product_reference": "ansible-runner-0:1.4.5-1.el8ar.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-runner-0:1.4.5-1.el8ar.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src" }, "product_reference": "ansible-runner-0:1.4.5-1.el8ar.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-runner-service-0:1.0.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch" }, "product_reference": "ansible-runner-service-0:1.0.2-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ansible-runner-service-0:1.0.2-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src" }, "product_reference": "ansible-runner-service-0:1.0.2-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-collections4-0:4.4-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch" }, "product_reference": "apache-commons-collections4-0:4.4-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-collections4-0:4.4-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src" }, "product_reference": "apache-commons-collections4-0:4.4-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch" }, "product_reference": "apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-compress-0:1.18-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch" }, "product_reference": "apache-commons-compress-0:1.18-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-compress-0:1.18-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src" }, "product_reference": "apache-commons-compress-0:1.18-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch" }, "product_reference": "apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-configuration-0:1.10-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch" }, "product_reference": "apache-commons-configuration-0:1.10-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-configuration-0:1.10-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src" }, "product_reference": "apache-commons-configuration-0:1.10-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-jexl-0:2.1.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch" }, "product_reference": "apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-jexl-0:2.1.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src" }, "product_reference": "apache-commons-jexl-0:2.1.1-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch" }, "product_reference": "apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-jxpath-0:1.3-29.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch" }, "product_reference": "apache-commons-jxpath-0:1.3-29.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-jxpath-0:1.3-29.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src" }, "product_reference": "apache-commons-jxpath-0:1.3-29.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch" }, "product_reference": "apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-vfs-0:2.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch" }, "product_reference": "apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-vfs-0:2.4.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src" }, "product_reference": "apache-commons-vfs-0:2.4.1-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch" }, "product_reference": "apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch" }, "product_reference": "apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch" }, "product_reference": "apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-sshd-0:2.5.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch" }, "product_reference": "apache-sshd-0:2.5.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-sshd-0:2.5.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src" }, "product_reference": "apache-sshd-0:2.5.1-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch" }, "product_reference": "apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ebay-cors-filter-0:1.0.1-4.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch" }, "product_reference": "ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ebay-cors-filter-0:1.0.1-4.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src" }, "product_reference": "ebay-cors-filter-0:1.0.1-4.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ed25519-java-0:0.3.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch" }, "product_reference": "ed25519-java-0:0.3.0-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ed25519-java-0:0.3.0-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src" }, "product_reference": "ed25519-java-0:0.3.0-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch" }, "product_reference": "ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "engine-db-query-0:1.6.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch" }, "product_reference": "engine-db-query-0:1.6.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "engine-db-query-0:1.6.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src" }, "product_reference": "engine-db-query-0:1.6.1-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "java-client-kubevirt-0:0.5.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch" }, "product_reference": "java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "java-client-kubevirt-0:0.5.0-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src" }, "product_reference": "java-client-kubevirt-0:0.5.0-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "log4j12-0:1.2.17-22.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch" }, "product_reference": "log4j12-0:1.2.17-22.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "log4j12-0:1.2.17-22.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src" }, "product_reference": "log4j12-0:1.2.17-22.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "log4j12-javadoc-0:1.2.17-22.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch" }, "product_reference": "log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "m2crypto-0:0.35.2-5.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src" }, "product_reference": "m2crypto-0:0.35.2-5.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64 as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64" }, "product_reference": "m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "makeself-0:2.4.0-4.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch" }, "product_reference": "makeself-0:2.4.0-4.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "makeself-0:2.4.0-4.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src" }, "product_reference": "makeself-0:2.4.0-4.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "novnc-0:1.1.0-1.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch" }, "product_reference": "novnc-0:1.1.0-1.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "novnc-0:1.1.0-1.el8ost.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src" }, "product_reference": "novnc-0:1.1.0-1.el8ost.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-client-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-client-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-glance-client-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-glance-model-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-heat-client-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-heat-model-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-javadoc-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-nova-client-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-nova-model-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-sdk-0:3.2.9-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src" }, "product_reference": "openstack-java-sdk-0:3.2.9-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-swift-client-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "openstack-java-swift-model-0:3.2.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch" }, "product_reference": "openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch" }, "product_reference": "ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-cockpit-sso-0:0.1.4-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src" }, "product_reference": "ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-0:4.4.1.8-0.7.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src" }, "product_reference": "ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch" }, "product_reference": "ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src" }, "product_reference": "ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch" }, "product_reference": "ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src" }, "product_reference": "ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch" }, "product_reference": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch" }, "product_reference": "ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch" }, "product_reference": "ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src" }, "product_reference": "ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch" }, "product_reference": "ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src" }, "product_reference": "ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch" }, "product_reference": "ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch" }, "product_reference": "ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src" }, "product_reference": "ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch" }, "product_reference": "ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src" }, "product_reference": "ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch" }, "product_reference": "ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src" }, "product_reference": "ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch" }, "product_reference": "ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch" }, "product_reference": "ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src" }, "product_reference": "ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch" }, "product_reference": "ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src" }, "product_reference": "ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch" }, "product_reference": "ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src" }, "product_reference": "ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-log-collector-0:4.4.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch" }, "product_reference": "ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-log-collector-0:4.4.2-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src" }, "product_reference": "ovirt-log-collector-0:4.4.2-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch" }, "product_reference": "ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src" }, "product_reference": "ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-web-ui-0:1.6.3-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch" }, "product_reference": "ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-web-ui-0:1.6.3-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src" }, "product_reference": "ovirt-web-ui-0:1.6.3-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-aniso8601-0:0.82-4.el8ost.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src" }, "product_reference": "python-aniso8601-0:0.82-4.el8ost.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-flask-1:1.0.2-2.el8ost.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src" }, "product_reference": "python-flask-1:1.0.2-2.el8ost.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-flask-doc-1:1.0.2-2.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch" }, "product_reference": "python-flask-doc-1:1.0.2-2.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-flask-restful-0:0.3.6-8.el8ost.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src" }, "product_reference": "python-flask-restful-0:0.3.6-8.el8ost.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-netaddr-0:0.7.19-8.1.el8ost.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src" }, "product_reference": "python-netaddr-0:0.7.19-8.1.el8ost.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-notario-0:0.0.16-2.el8cp.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src" }, "product_reference": "python-notario-0:0.0.16-2.el8cp.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src" }, "product_reference": "python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-pbr-0:5.1.2-2.el8ost.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src" }, "product_reference": "python-pbr-0:5.1.2-2.el8ost.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-six-0:1.12.0-1.el8ost.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src" }, "product_reference": "python-six-0:1.12.0-1.el8ost.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-websocket-client-0:0.54.0-1.el8ost.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src" }, "product_reference": "python-websocket-client-0:0.54.0-1.el8ost.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python-werkzeug-0:0.16.0-1.el8ost.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src" }, "product_reference": "python-werkzeug-0:0.16.0-1.el8ost.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python2-netaddr-0:0.7.19-8.1.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch" }, "product_reference": "python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python2-pbr-0:5.1.2-2.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch" }, "product_reference": "python2-pbr-0:5.1.2-2.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python2-six-0:1.12.0-1.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch" }, "product_reference": "python2-six-0:1.12.0-1.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-aniso8601-0:0.82-4.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch" }, "product_reference": "python3-aniso8601-0:0.82-4.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-ansible-runner-0:1.4.5-1.el8ar.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch" }, "product_reference": "python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-flask-1:1.0.2-2.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch" }, "product_reference": "python3-flask-1:1.0.2-2.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-flask-restful-0:0.3.6-8.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch" }, "product_reference": "python3-flask-restful-0:0.3.6-8.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-m2crypto-0:0.35.2-5.el8ev.x86_64 as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64" }, "product_reference": "python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64 as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64" }, "product_reference": "python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-netaddr-0:0.7.19-8.1.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch" }, "product_reference": "python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-notario-0:0.0.16-2.el8cp.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch" }, "product_reference": "python3-notario-0:0.0.16-2.el8cp.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch" }, "product_reference": "python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-pbr-0:5.1.2-2.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch" }, "product_reference": "python3-pbr-0:5.1.2-2.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-six-0:1.12.0-1.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch" }, "product_reference": "python3-six-0:1.12.0-1.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-websocket-client-0:0.54.0-1.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch" }, "product_reference": "python3-websocket-client-0:0.54.0-1.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-werkzeug-0:0.16.0-1.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch" }, "product_reference": "python3-werkzeug-0:0.16.0-1.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch" }, "product_reference": "python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch" }, "product_reference": "rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src" }, "product_reference": "rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-0:4.4.1.8-0.7.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch" }, "product_reference": "rhvm-0:4.4.1.8-0.7.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch" }, "product_reference": "rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-branding-rhv-0:4.4.4-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src" }, "product_reference": "rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-dependencies-0:4.4.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch" }, "product_reference": "rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-dependencies-0:4.4.0-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src" }, "product_reference": "rhvm-dependencies-0:4.4.0-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch" }, "product_reference": "rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-setup-plugins-0:4.4.2-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src" }, "product_reference": "rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "snmp4j-0:2.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch" }, "product_reference": "snmp4j-0:2.4.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "snmp4j-0:2.4.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src" }, "product_reference": "snmp4j-0:2.4.1-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "snmp4j-javadoc-0:2.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch" }, "product_reference": "snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch" }, "product_reference": "unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "unboundid-ldapsdk-0:4.0.14-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src" }, "product_reference": "unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch" }, "product_reference": "unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch" }, "product_reference": "vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src" }, "product_reference": "vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ws-commons-util-0:1.0.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch" }, "product_reference": "ws-commons-util-0:1.0.2-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ws-commons-util-0:1.0.2-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src" }, "product_reference": "ws-commons-util-0:1.0.2-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch" }, "product_reference": "ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "xmlrpc-0:3.1.3-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src" }, "product_reference": "xmlrpc-0:3.1.3-1.el8ev.src", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "xmlrpc-client-0:3.1.3-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch" }, "product_reference": "xmlrpc-client-0:3.1.3-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "xmlrpc-common-0:3.1.3-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch" }, "product_reference": "xmlrpc-common-0:3.1.3-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch" }, "product_reference": "xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" }, { "category": "default_component_of", "full_product_name": { "name": "xmlrpc-server-0:3.1.3-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4", "product_id": "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" }, "product_reference": "xmlrpc-server-0:3.1.3-1.el8ev.noarch", "relates_to_product_reference": "8Base-RHV-S-4.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2017-18635", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-10-25T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1765660" } ], "notes": [ { "category": "description", "text": "An XSS vulnerability was discovered in noVNC in which arbitrary HTML could be injected into the noVNC web page. An attacker having access to a VNC server could use target host values in a crafted URL to gain access to secure information (such as VM tokens).", "title": "Vulnerability description" }, { "category": "summary", "text": "novnc: XSS vulnerability via the messages propagated to the status field", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-18635" }, { "category": "external", "summary": "RHBZ#1765660", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1765660" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-18635", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18635" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-18635", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18635" }, { "category": "external", "summary": "https://github.com/novnc/noVNC/releases/tag/v0.6.2", "url": "https://github.com/novnc/noVNC/releases/tag/v0.6.2" } ], "release_date": "2019-01-12T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-08-04T14:02:29+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3247" }, { "category": "workaround", "details": "There is no known mitigation for this issue, the flaw can only be resolved by applying updates.", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "novnc: XSS vulnerability via the messages propagated to the status field" }, { "cve": "CVE-2019-8331", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-02-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1686454" } ], "notes": [ { "category": "description", "text": "A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the tooltip or popover data-template attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-8331" }, { "category": "external", "summary": "RHBZ#1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-8331", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8331" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331" } ], "release_date": "2019-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-08-04T14:02:29+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3247" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "bootstrap: XSS in the tooltip or popover data-template attribute" }, { "cve": "CVE-2019-13990", "cwe": { "id": "CWE-611", "name": "Improper Restriction of XML External Entity Reference" }, "discovery_date": "2019-07-27T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1801149" } ], "notes": [ { "category": "description", "text": "The Terracotta Quartz Scheduler is susceptible to an XML external entity attack (XXE) through a job description. This issue stems from inadequate handling of XML external entity (XXE) declarations in the initDocumentParser function within xml/XMLSchedulingDataProcessor.java. By enticing a victim to access a maliciously crafted job description (containing XML content), a remote attacker could exploit this vulnerability to execute an XXE attack on the targeted system.", "title": "Vulnerability description" }, { "category": "summary", "text": "libquartz: XXE attacks via job description", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6 uses a vulnerable version of libquartz as a dependency for Candlepin. However, the \u003cjob\u003e\u003cdescrition\u003e entry is not used, and the vulnerability can not be triggered. An update may fix the code in the future.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-13990" }, { "category": "external", "summary": "RHBZ#1801149", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801149" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-13990", "url": "https://www.cve.org/CVERecord?id=CVE-2019-13990" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-13990", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-13990" } ], "release_date": "2019-07-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-08-04T14:02:29+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3247" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "libquartz: XXE attacks via job description" }, { "acknowledgments": [ { "names": [ "@_w4rr4nt_" ] } ], "cve": "CVE-2019-19336", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-12-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1781001" } ], "notes": [ { "category": "description", "text": "A cross-site scripting vulnerability was reported in the oVirt-engine\u0027s OAuth authorization endpoint. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user\u0027s oVirt session.", "title": "Vulnerability description" }, { "category": "summary", "text": "ovirt-engine: response_type parameter allows reflected XSS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-19336" }, { "category": "external", "summary": "RHBZ#1781001", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1781001" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-19336", "url": "https://www.cve.org/CVERecord?id=CVE-2019-19336" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-19336", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19336" } ], "release_date": "2020-01-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-08-04T14:02:29+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3247" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ovirt-engine: response_type parameter allows reflected XSS" }, { "cve": "CVE-2020-7598", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2020-03-11T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1813344" } ], "notes": [ { "category": "description", "text": "A flaw was found in nodejs-minimist, where it was tricked into adding or modifying properties of the Object.prototype using a \"constructor\" or \"__proto__\" payload. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Quay only includes minimist as a dependency of the test suites, and it not include it in the product. We may fix this issue in a future Red Hat Quay release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-7598" }, { "category": "external", "summary": "RHBZ#1813344", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1813344" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-7598", "url": "https://www.cve.org/CVERecord?id=CVE-2020-7598" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-7598" }, { "category": "external", "summary": "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764", "url": "https://snyk.io/vuln/SNYK-JS-MINIMIST-559764" } ], "release_date": "2020-03-10T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-08-04T14:02:29+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3247" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1" }, "products": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload" }, { "acknowledgments": [ { "names": [ "Chen Huiliang", "Chen RuiQi" ], "organization": "QIANXIN CodeSafe Team" } ], "cve": "CVE-2020-10775", "cwe": { "id": "CWE-601", "name": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)" }, "discovery_date": "2020-06-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1847420" } ], "notes": [ { "category": "description", "text": "An Open redirect vulnerability was found in ovirt-engine versions 4.4.1 and earlier, where it allows remote attackers to redirect users to arbitrary web sites and attempt phishing attacks. Once the target has opened the malicious URL in their browser, the critical part of the URL is no longer visible. The highest threat from this vulnerability is on confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "ovirt-engine: Redirect to arbitrary URL allows for phishing", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat Gluster Storage 3, ovirt-engine(included in rhsc) was shipped as a part of Red Hat Gluster Storage Console that is no longer supported for use with Red Hat Gluster Storage 3.5. Red Hat Gluster Storage Web Administration is now the recommended monitoring tool for Red Hat Storage Gluster clusters. However, the vulnerable code is not included in the shipped version of ovirt-engine hence not affected by this flaw.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10775" }, { "category": "external", "summary": "RHBZ#1847420", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1847420" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10775", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10775" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10775", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10775" } ], "release_date": "2020-08-04T09:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-08-04T14:02:29+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3247" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1" }, "products": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "ovirt-engine: Redirect to arbitrary URL allows for phishing" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-08-04T14:02:29+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3247" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis controls ensure that security flaws, including XSS vulnerabilities, are detected early in development by scanning code for improper input handling. This prevents vulnerable code from reaching production and encourages our developers to follow secure coding practices. System monitoring controls play a crucial role in detecting and responding to XSS attacks by analyzing logs, monitoring user behavior, and generating alerts for suspicious activity. Meanwhile, AWS WAF (Web Application Firewall) adds an extra layer of defense by filtering and blocking malicious input before it reaches the platform and/or application. Together, these controls create a defense-in-depth approach, reducing the risk of XSS exploitation by preventing, detecting, and mitigating attacks at multiple levels.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src" ], "known_not_affected": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-08-04T14:02:29+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:3247" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.", "product_ids": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:ansible-runner-0:1.4.5-1.el8ar.src", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-collections4-0:4.4-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-compress-0:1.18-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-configuration-0:1.10-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jexl-0:2.1.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-jxpath-0:1.3-29.el8ev.src", "8Base-RHV-S-4.4:apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:apache-sshd-0:2.5.1-1.el8ev.src", "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.noarch", "8Base-RHV-S-4.4:ebay-cors-filter-0:1.0.1-4.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ed25519-java-0:0.3.0-1.el8ev.src", "8Base-RHV-S-4.4:ed25519-java-javadoc-0:0.3.0-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.noarch", "8Base-RHV-S-4.4:engine-db-query-0:1.6.1-1.el8ev.src", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.noarch", "8Base-RHV-S-4.4:java-client-kubevirt-0:0.5.0-1.el8ev.src", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:log4j12-0:1.2.17-22.el8ev.src", "8Base-RHV-S-4.4:log4j12-javadoc-0:1.2.17-22.el8ev.noarch", "8Base-RHV-S-4.4:m2crypto-0:0.35.2-5.el8ev.src", "8Base-RHV-S-4.4:m2crypto-debugsource-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.noarch", "8Base-RHV-S-4.4:makeself-0:2.4.0-4.el8ev.src", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.noarch", "8Base-RHV-S-4.4:novnc-0:1.1.0-1.el8ost.src", "8Base-RHV-S-4.4:openstack-java-ceilometer-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-ceilometer-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-cinder-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-glance-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-heat-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-javadoc-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-keystone-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-nova-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-quantum-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-resteasy-connector-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-sdk-0:3.2.9-1.el8ev.src", "8Base-RHV-S-4.4:openstack-java-swift-client-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:openstack-java-swift-model-0:3.2.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-cockpit-sso-0:0.1.4-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-0:4.4.1.8-0.7.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-api-explorer-0:0.0.6-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.1.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.1.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-jdbc-0:1.2.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-0:1.4.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-ldap-setup-0:1.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-aaa-misc-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extension-logger-log4j-0:1.1.0-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-0:1.0.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-extensions-api-javadoc-0:1.0.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-metrics-0:1.4.1.1-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-ui-extensions-0:1.2.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-fast-forward-upgrade-0:1.1.6-0.el8ev.src", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-log-collector-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-scheduler-proxy-0:0.1.9-1.el8ev.src", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.noarch", "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.3-1.el8ev.src", "8Base-RHV-S-4.4:python-aniso8601-0:0.82-4.el8ost.src", "8Base-RHV-S-4.4:python-flask-1:1.0.2-2.el8ost.src", "8Base-RHV-S-4.4:python-flask-doc-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python-flask-restful-0:0.3.6-8.el8ost.src", "8Base-RHV-S-4.4:python-netaddr-0:0.7.19-8.1.el8ost.src", "8Base-RHV-S-4.4:python-notario-0:0.0.16-2.el8cp.src", "8Base-RHV-S-4.4:python-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.src", "8Base-RHV-S-4.4:python-pbr-0:5.1.2-2.el8ost.src", "8Base-RHV-S-4.4:python-six-0:1.12.0-1.el8ost.src", "8Base-RHV-S-4.4:python-websocket-client-0:0.54.0-1.el8ost.src", "8Base-RHV-S-4.4:python-werkzeug-0:0.16.0-1.el8ost.src", "8Base-RHV-S-4.4:python2-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python2-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python2-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-aniso8601-0:0.82-4.el8ost.noarch", "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.5-1.el8ar.noarch", "8Base-RHV-S-4.4:python3-flask-1:1.0.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-flask-restful-0:0.3.6-8.el8ost.noarch", "8Base-RHV-S-4.4:python3-m2crypto-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-m2crypto-debuginfo-0:0.35.2-5.el8ev.x86_64", "8Base-RHV-S-4.4:python3-netaddr-0:0.7.19-8.1.el8ost.noarch", "8Base-RHV-S-4.4:python3-notario-0:0.0.16-2.el8cp.noarch", "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:python3-ovsdbapp-0:0.17.1-0.20191216120142.206cf14.el8ost.noarch", "8Base-RHV-S-4.4:python3-pbr-0:5.1.2-2.el8ost.noarch", "8Base-RHV-S-4.4:python3-six-0:1.12.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-websocket-client-0:0.54.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:python3-werkzeug-doc-0:0.16.0-1.el8ost.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhv-log-collector-analyzer-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-0:4.4.1.8-0.7.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-branding-rhv-0:4.4.4-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-dependencies-0:4.4.0-1.el8ev.src", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.noarch", "8Base-RHV-S-4.4:rhvm-setup-plugins-0:4.4.2-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:snmp4j-0:2.4.1-1.el8ev.src", "8Base-RHV-S-4.4:snmp4j-javadoc-0:2.4.1-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:unboundid-ldapsdk-0:4.0.14-1.el8ev.src", "8Base-RHV-S-4.4:unboundid-ldapsdk-javadoc-0:4.0.14-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.noarch", "8Base-RHV-S-4.4:vdsm-jsonrpc-java-0:1.5.4-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:ws-commons-util-0:1.0.2-1.el8ev.src", "8Base-RHV-S-4.4:ws-commons-util-javadoc-0:1.0.2-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-0:3.1.3-1.el8ev.src", "8Base-RHV-S-4.4:xmlrpc-client-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-common-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-javadoc-0:3.1.3-1.el8ev.noarch", "8Base-RHV-S-4.4:xmlrpc-server-0:3.1.3-1.el8ev.noarch" ] } ], "threats": [ { "category": "exploit_status", "date": "2025-01-23T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" } ] }
RHSA-2020:2813
Vulnerability from csaf_redhat
Published
2020-07-02 13:21
Modified
2025-07-10 20:16
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.4.1 security update
Notes
Topic
A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.4.1 serves as a replacement for Red Hat Single Sign-On 7.4.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: verify-token-audience support is missing in the NodeJS adapter (CVE-2020-1694)
* keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution (CVE-2020-1714)
* js-jquery: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* js-jquery: jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* undertow: invalid HTTP request with large chunk size (CVE-2020-10719)
* keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697) (CVE-2020-10748)
* jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)
* jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)
* jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)
* jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.4.1 serves as a replacement for Red Hat Single Sign-On 7.4.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: verify-token-audience support is missing in the NodeJS adapter (CVE-2020-1694)\n\n* keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution (CVE-2020-1714)\n\n* js-jquery: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* js-jquery: jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n\n* undertow: invalid HTTP request with large chunk size (CVE-2020-10719)\n\n* keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697) (CVE-2020-10748)\n\n* jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)\n\n* jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)\n\n* jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)\n\n* jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2813", "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=core.service.rhsso\u0026version=7.4", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=core.service.rhsso\u0026version=7.4" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/" }, { "category": "external", "summary": "1705975", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1705975" }, { "category": "external", "summary": "1790759", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790759" }, { "category": "external", "summary": "1816330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816330" }, { "category": "external", "summary": "1816332", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816332" }, { "category": "external", "summary": "1816337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816337" }, { "category": "external", "summary": "1816340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816340" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1828459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828459" }, { "category": "external", "summary": "1836786", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1836786" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2813.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.4.1 security update", "tracking": { "current_release_date": "2025-07-10T20:16:24+00:00", "generator": { "date": "2025-07-10T20:16:24+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2020:2813", "initial_release_date": "2020-07-02T13:21:10+00:00", "revision_history": [ { "date": "2020-07-02T13:21:10+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-02T13:21:10+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-10T20:16:24+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.4.1", "product": { "name": "Red Hat Single Sign-On 7.4.1", "product_id": "Red Hat Single Sign-On 7.4.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_single_sign_on:7.4" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-1694", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "discovery_date": "2019-12-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1790759" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: verify-token-audience support is missing in the NodeJS adapter", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1694" }, { "category": "external", "summary": "RHBZ#1790759", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790759" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1694", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1694" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1694", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1694" } ], "release_date": "2020-07-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: verify-token-audience support is missing in the NodeJS adapter" }, { "acknowledgments": [ { "names": [ "Thomas Darimont" ] } ], "cve": "CVE-2020-1714", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-04-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1705975" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1714" }, { "category": "external", "summary": "RHBZ#1705975", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1705975" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1714", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1714" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1714", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1714" } ], "release_date": "2020-05-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "workaround", "details": "There is currently no known mitigation for this issue.", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution" }, { "cve": "CVE-2020-8840", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816330" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A \"gadget\" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8840" }, { "category": "external", "summary": "RHBZ#1816330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816330" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8840", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8840" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking" }, { "cve": "CVE-2020-9546", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816332" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in shaded-hikari-config", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-9546" }, { "category": "external", "summary": "RHBZ#1816332", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816332" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9546", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9546" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9546", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9546" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Serialization gadgets in shaded-hikari-config" }, { "cve": "CVE-2020-9547", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816337" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in ibatis-sqlmap", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-9547" }, { "category": "external", "summary": "RHBZ#1816337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816337" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9547", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9547" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Serialization gadgets in ibatis-sqlmap" }, { "cve": "CVE-2020-9548", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816340" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in anteros-core", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-9548" }, { "category": "external", "summary": "RHBZ#1816340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816340" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9548", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Serialization gadgets in anteros-core" }, { "acknowledgments": [ { "names": [ "ZeddYu" ] } ], "cve": "CVE-2020-10719", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2020-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828459" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.", "title": "Vulnerability description" }, { "category": "summary", "text": "undertow: invalid HTTP request with large chunk size", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10719" }, { "category": "external", "summary": "RHBZ#1828459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828459" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10719", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10719" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10719", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10719" } ], "release_date": "2020-05-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "undertow: invalid HTTP request with large chunk size" }, { "acknowledgments": [ { "names": [ "Lauritz Holtmann" ], "organization": "Chair for Network and Data Security at Ruhr University Bochum" } ], "cve": "CVE-2020-10748", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-05-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1836786" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s data filter, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10748" }, { "category": "external", "summary": "RHBZ#1836786", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1836786" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10748", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10748" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10748", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10748" } ], "release_date": "2020-07-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)" }, { "cve": "CVE-2020-10969", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1819212" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in javax.swing.JEditorPane", "title": "Vulnerability summary" }, { "category": "other", "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nThe PKI module as shipped in Red Hat Enterprise Linux 8 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used, lowering the impact of the vulnerability for the Product. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10969" }, { "category": "external", "summary": "RHBZ#1819212", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819212" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10969" } ], "release_date": "2020-03-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "workaround", "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jackson-databind: Serialization gadgets in javax.swing.JEditorPane" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis controls ensure that security flaws, including XSS vulnerabilities, are detected early in development by scanning code for improper input handling. This prevents vulnerable code from reaching production and encourages our developers to follow secure coding practices. System monitoring controls play a crucial role in detecting and responding to XSS attacks by analyzing logs, monitoring user behavior, and generating alerts for suspicious activity. Meanwhile, AWS WAF (Web Application Firewall) adds an extra layer of defense by filtering and blocking malicious input before it reaches the platform and/or application. Together, these controls create a defense-in-depth approach, reducing the risk of XSS exploitation by preventing, detecting, and mitigating attacks at multiple levels.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "exploit_status", "date": "2025-01-23T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" } ] }
rhsa-2020:2813
Vulnerability from csaf_redhat
Published
2020-07-02 13:21
Modified
2025-07-10 20:16
Summary
Red Hat Security Advisory: Red Hat Single Sign-On 7.4.1 security update
Notes
Topic
A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.
This release of Red Hat Single Sign-On 7.4.1 serves as a replacement for Red Hat Single Sign-On 7.4.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* keycloak: verify-token-audience support is missing in the NodeJS adapter (CVE-2020-1694)
* keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution (CVE-2020-1714)
* js-jquery: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
* js-jquery: jQuery: passing HTML containing <option> elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)
* undertow: invalid HTTP request with large chunk size (CVE-2020-10719)
* keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697) (CVE-2020-10748)
* jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)
* jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)
* jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)
* jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A security update is now available for Red Hat Single Sign-On 7.4 from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Single Sign-On 7.4 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.\n\nThis release of Red Hat Single Sign-On 7.4.1 serves as a replacement for Red Hat Single Sign-On 7.4.0, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.\n\nSecurity Fix(es):\n\n* keycloak: verify-token-audience support is missing in the NodeJS adapter (CVE-2020-1694)\n\n* keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution (CVE-2020-1714)\n\n* js-jquery: jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)\n\n* js-jquery: jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution (CVE-2020-11023)\n\n* undertow: invalid HTTP request with large chunk size (CVE-2020-10719)\n\n* keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697) (CVE-2020-10748)\n\n* jackson-databind: Lacks certain xbean-reflect/JNDI blocking (CVE-2020-8840)\n\n* jackson-databind: Serialization gadgets in shaded-hikari-config (CVE-2020-9546)\n\n* jackson-databind: Serialization gadgets in ibatis-sqlmap (CVE-2020-9547)\n\n* jackson-databind: Serialization gadgets in anteros-core (CVE-2020-9548)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:2813", "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=core.service.rhsso\u0026version=7.4", "url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches\u0026product=core.service.rhsso\u0026version=7.4" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.4/" }, { "category": "external", "summary": "1705975", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1705975" }, { "category": "external", "summary": "1790759", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790759" }, { "category": "external", "summary": "1816330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816330" }, { "category": "external", "summary": "1816332", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816332" }, { "category": "external", "summary": "1816337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816337" }, { "category": "external", "summary": "1816340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816340" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1828459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828459" }, { "category": "external", "summary": "1836786", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1836786" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_2813.json" } ], "title": "Red Hat Security Advisory: Red Hat Single Sign-On 7.4.1 security update", "tracking": { "current_release_date": "2025-07-10T20:16:24+00:00", "generator": { "date": "2025-07-10T20:16:24+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2020:2813", "initial_release_date": "2020-07-02T13:21:10+00:00", "revision_history": [ { "date": "2020-07-02T13:21:10+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-07-02T13:21:10+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-10T20:16:24+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Single Sign-On 7.4.1", "product": { "name": "Red Hat Single Sign-On 7.4.1", "product_id": "Red Hat Single Sign-On 7.4.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_single_sign_on:7.4" } } } ], "category": "product_family", "name": "Red Hat Single Sign-On" } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2020-1694", "cwe": { "id": "CWE-732", "name": "Incorrect Permission Assignment for Critical Resource" }, "discovery_date": "2019-12-24T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1790759" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: verify-token-audience support is missing in the NodeJS adapter", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1694" }, { "category": "external", "summary": "RHBZ#1790759", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1790759" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1694", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1694" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1694", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1694" } ], "release_date": "2020-07-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "keycloak: verify-token-audience support is missing in the NodeJS adapter" }, { "acknowledgments": [ { "names": [ "Thomas Darimont" ] } ], "cve": "CVE-2020-1714", "cwe": { "id": "CWE-20", "name": "Improper Input Validation" }, "discovery_date": "2019-04-29T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1705975" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak, where the code base contains usages of ObjectInputStream without type checks. This flaw allows an attacker to inject arbitrarily serialized Java Objects, which would then get deserialized in a privileged context and potentially lead to remote code execution.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-1714" }, { "category": "external", "summary": "RHBZ#1705975", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1705975" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-1714", "url": "https://www.cve.org/CVERecord?id=CVE-2020-1714" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-1714", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-1714" } ], "release_date": "2020-05-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "workaround", "details": "There is currently no known mitigation for this issue.", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution" }, { "cve": "CVE-2020-8840", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816330" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A \"gadget\" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-8840" }, { "category": "external", "summary": "RHBZ#1816330", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816330" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-8840", "url": "https://www.cve.org/CVERecord?id=CVE-2020-8840" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-8840" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Lacks certain xbean-reflect/JNDI blocking" }, { "cve": "CVE-2020-9546", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816332" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in shaded-hikari-config", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-9546" }, { "category": "external", "summary": "RHBZ#1816332", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816332" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9546", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9546" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9546", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9546" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Serialization gadgets in shaded-hikari-config" }, { "cve": "CVE-2020-9547", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816337" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in ibatis-sqlmap", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-9547" }, { "category": "external", "summary": "RHBZ#1816337", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816337" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9547", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9547" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9547" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Serialization gadgets in ibatis-sqlmap" }, { "cve": "CVE-2020-9548", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-02T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1816340" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x. FasterXML jackson-databind 2.x mishandles the interaction between serialization gadgets and typing. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in anteros-core", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nWhile OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-9548" }, { "category": "external", "summary": "RHBZ#1816340", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1816340" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-9548", "url": "https://www.cve.org/CVERecord?id=CVE-2020-9548" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-9548" } ], "release_date": "2020-03-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: Serialization gadgets in anteros-core" }, { "acknowledgments": [ { "names": [ "ZeddYu" ] } ], "cve": "CVE-2020-10719", "cwe": { "id": "CWE-444", "name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)" }, "discovery_date": "2020-02-11T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828459" } ], "notes": [ { "category": "description", "text": "A flaw was found in Undertow, regarding the processing of invalid HTTP requests with large chunk sizes. This flaw allows an attacker to take advantage of HTTP request smuggling.", "title": "Vulnerability description" }, { "category": "summary", "text": "undertow: invalid HTTP request with large chunk size", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10719" }, { "category": "external", "summary": "RHBZ#1828459", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828459" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10719", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10719" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10719", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10719" } ], "release_date": "2020-05-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "undertow: invalid HTTP request with large chunk size" }, { "acknowledgments": [ { "names": [ "Lauritz Holtmann" ], "organization": "Chair for Network and Data Security at Ruhr University Bochum" } ], "cve": "CVE-2020-10748", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-05-18T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1836786" } ], "notes": [ { "category": "description", "text": "A flaw was found in Keycloak\u0027s data filter, where it allowed the processing of data URLs in some circumstances. This flaw allows an attacker to conduct cross-site scripting or further attacks.", "title": "Vulnerability description" }, { "category": "summary", "text": "keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10748" }, { "category": "external", "summary": "RHBZ#1836786", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1836786" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10748", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10748" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10748", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10748" } ], "release_date": "2020-07-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "keycloak: top-level navigations to data URLs resulting in XSS are possible (incomplete fix of CVE-2020-1697)" }, { "cve": "CVE-2020-10969", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2020-03-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1819212" } ], "notes": [ { "category": "description", "text": "A flaw was found in jackson-databind 2.x in versions prior to 2.9.10.4. The interaction between serialization gadgets and typing is mishandled. The highest threat from this vulnerability is to data confidentiality.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: Serialization gadgets in javax.swing.JEditorPane", "title": "Vulnerability summary" }, { "category": "other", "text": "While OpenShift Container Platform\u0027s elasticsearch plugins do ship the vulnerable component, it doesn\u0027t do any of the unsafe things described in https://access.redhat.com/solutions/3279231. We may update the jackson-databind dependency in a future release.\n\nRed Hat OpenStack Platform ships OpenDaylight, which contains the vulnerable jackson-databind. However, OpenDaylight does not expose jackson-databind in a way that would make it vulnerable, lowering the impact of the vulnerability for OpenDaylight. As such, Red Hat will not be providing a fix for OpenDaylight at this time.\n\nRed Hat Satellite 6 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used. We may update the jackson-databind dependency in a future release.\n\nThe PKI module as shipped in Red Hat Enterprise Linux 8 does not enable polymorphic deserialization which is a required configuration for the vulnerability to be used, lowering the impact of the vulnerability for the Product. We may update the jackson-databind dependency in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-10969" }, { "category": "external", "summary": "RHBZ#1819212", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1819212" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-10969", "url": "https://www.cve.org/CVERecord?id=CVE-2020-10969" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-10969", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-10969" } ], "release_date": "2020-03-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "workaround", "details": "The following conditions are needed for an exploit, we recommend avoiding all if possible\n* Deserialization from sources you do not control\n* `enableDefaultTyping()`\n* `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "jackson-databind: Serialization gadgets in javax.swing.JEditorPane" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis controls ensure that security flaws, including XSS vulnerabilities, are detected early in development by scanning code for improper input handling. This prevents vulnerable code from reaching production and encourages our developers to follow secure coding practices. System monitoring controls play a crucial role in detecting and responding to XSS attacks by analyzing logs, monitoring user behavior, and generating alerts for suspicious activity. Meanwhile, AWS WAF (Web Application Firewall) adds an extra layer of defense by filtering and blocking malicious input before it reaches the platform and/or application. Together, these controls create a defense-in-depth approach, reducing the risk of XSS exploitation by preventing, detecting, and mitigating attacks at multiple levels.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "Red Hat Single Sign-On 7.4.1" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-07-02T13:21:10+00:00", "details": "Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.\n\nThe References section of this erratum contains a download link (you must log in to download the update).", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:2813" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.", "product_ids": [ "Red Hat Single Sign-On 7.4.1" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "Red Hat Single Sign-On 7.4.1" ] } ], "threats": [ { "category": "exploit_status", "date": "2025-01-23T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Moderate" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" } ] }
rhsa-2023:0554
Vulnerability from csaf_redhat
Published
2023-01-31 13:15
Modified
2025-07-10 20:17
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
Notes
Topic
An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* jquery: Prototype pollution in object's prototype leading to denial of
service, remote code execution, or property injection (CVE-2019-11358)
* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
(CVE-2018-14040)
* jquery: Untrusted code execution via <option> tag in HTML passed to DOM
manipulation methods (CVE-2020-11023)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
(CVE-2020-11022)
* bootstrap: XSS in the data-target attribute (CVE-2016-10735)
* bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy
(CVE-2018-14041)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability
(CVE-2022-45047)
* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of
Service attacks (CVE-2022-40152)
* bootstrap: Cross-site Scripting (XSS) in the data-container property of
tooltip (CVE-2018-14042)
* bootstrap: XSS in the tooltip or popover data-template attribute
(CVE-2019-8331)
* nodejs-moment: Regular expression denial of service (CVE-2017-18214)
* wildfly-elytron: possible timing attacks via use of unsafe comparator
(CVE-2022-3143)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS
(CVE-2022-42003)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jettison: memory exhaustion via user-supplied XML or JSON data
(CVE-2022-40150)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 9.\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of\nservice, remote code execution, or property injection (CVE-2019-11358)\n\n* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)\n\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute\n(CVE-2018-14040)\n\n* jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM\nmanipulation methods (CVE-2020-11023)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method\n(CVE-2020-11022)\n\n* bootstrap: XSS in the data-target attribute (CVE-2016-10735)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy\n(CVE-2018-14041)\n\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability\n(CVE-2022-45047)\n\n* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of\nService attacks (CVE-2022-40152)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-container property of\ntooltip (CVE-2018-14042)\n\n* bootstrap: XSS in the tooltip or popover data-template attribute\n(CVE-2019-8331)\n\n* nodejs-moment: Regular expression denial of service (CVE-2017-18214)\n\n* wildfly-elytron: possible timing attacks via use of unsafe comparator\n(CVE-2022-3143)\n\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS\n(CVE-2022-42003)\n\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n\n* jettison: memory exhaustion via user-supplied XML or JSON data\n(CVE-2022-40150)\n\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0554", "url": "https://access.redhat.com/errata/RHSA-2023:0554" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/" }, { "category": "external", "summary": "1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "1553413", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553413" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601616" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "2124682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124682" }, { "category": "external", "summary": "2134291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134291" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "JBEAP-23864", "url": "https://issues.redhat.com/browse/JBEAP-23864" }, { "category": "external", "summary": "JBEAP-23865", "url": "https://issues.redhat.com/browse/JBEAP-23865" }, { "category": "external", "summary": "JBEAP-23866", "url": "https://issues.redhat.com/browse/JBEAP-23866" }, { "category": "external", "summary": "JBEAP-23928", "url": "https://issues.redhat.com/browse/JBEAP-23928" }, { "category": "external", "summary": "JBEAP-24055", "url": "https://issues.redhat.com/browse/JBEAP-24055" }, { "category": "external", "summary": "JBEAP-24081", "url": "https://issues.redhat.com/browse/JBEAP-24081" }, { "category": "external", "summary": "JBEAP-24095", "url": "https://issues.redhat.com/browse/JBEAP-24095" }, { "category": "external", "summary": "JBEAP-24100", "url": "https://issues.redhat.com/browse/JBEAP-24100" }, { "category": "external", "summary": "JBEAP-24127", "url": "https://issues.redhat.com/browse/JBEAP-24127" }, { "category": "external", "summary": "JBEAP-24128", "url": "https://issues.redhat.com/browse/JBEAP-24128" }, { "category": "external", "summary": "JBEAP-24132", "url": "https://issues.redhat.com/browse/JBEAP-24132" }, { "category": "external", "summary": "JBEAP-24147", "url": "https://issues.redhat.com/browse/JBEAP-24147" }, { "category": "external", "summary": "JBEAP-24167", "url": "https://issues.redhat.com/browse/JBEAP-24167" }, { "category": "external", "summary": "JBEAP-24191", "url": "https://issues.redhat.com/browse/JBEAP-24191" }, { "category": "external", "summary": "JBEAP-24195", "url": "https://issues.redhat.com/browse/JBEAP-24195" }, { "category": "external", "summary": "JBEAP-24207", "url": "https://issues.redhat.com/browse/JBEAP-24207" }, { "category": "external", "summary": "JBEAP-24248", "url": "https://issues.redhat.com/browse/JBEAP-24248" }, { "category": "external", "summary": "JBEAP-24426", "url": "https://issues.redhat.com/browse/JBEAP-24426" }, { "category": "external", "summary": "JBEAP-24427", "url": "https://issues.redhat.com/browse/JBEAP-24427" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0554.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update", "tracking": { "current_release_date": "2025-07-10T20:17:32+00:00", "generator": { "date": "2025-07-10T20:17:32+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2023:0554", "initial_release_date": "2023-01-31T13:15:23+00:00", "revision_history": [ { "date": "2023-01-31T13:15:23+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-01-31T13:15:23+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2025-07-10T20:17:32+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss EAP 7.4 for RHEL 9", "product": { "name": "Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el9" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform" }, { "branches": [ { "category": "product_version", "name": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-elytron-web@1.9.3-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "product": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_id": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-databind@2.12.7-1.redhat_00003.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src", "product": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src", "product_id": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-woodstox-core@6.4.0-1.redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "product": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_id": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-java8@2.12.7-1.redhat_00003.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "product": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "product_id": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-javaee-security-soteria@1.0.1-3.redhat_00003.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "product": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_id": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-annotations@2.12.7-1.redhat_00003.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "product": { "name": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_id": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-providers@2.12.7-1.redhat_00003.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "product": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_id": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-core@2.12.7-1.redhat_00003.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "product": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_id": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-base@2.12.7-1.redhat_00003.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "product": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "product_id": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jettison@1.5.2-1.redhat_00002.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "product": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "product_id": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.22-1.SP3_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-remoting@5.0.27-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.16-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.10-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsp-api_2.3_spec@2.0.0-3.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "product": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "product_id": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-sshd@2.9.2-1.redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-ejb-client@4.0.49-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "product": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "product_id": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsf-api_2.3_spec@3.0.0-6.SP07_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search@5.10.13-3.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "product": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "product_id": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.16-1.Final_redhat_00001.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "product_id": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-24.Final_redhat_00023.1.el9eap?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "product": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "product_id": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.9-4.GA_redhat_00003.1.el9eap?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow-server@1.9.3-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_id": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-databind@2.12.7-1.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "product_id": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-woodstox-core@6.4.0-1.redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_id": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-datatype-jdk8@2.12.7-1.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_id": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-datatype-jsr310@2.12.7-1.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_id": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-java8@2.12.7-1.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "product_id": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-javaee-security-soteria@1.0.1-3.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "product_id": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-javaee-security-soteria-enterprise@1.0.1-3.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_id": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-annotations@2.12.7-1.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_id": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-base@2.12.7-1.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_id": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-jaxrs-json-provider@2.12.7-1.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_id": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-core@2.12.7-1.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_id": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-module-jaxb-annotations@2.12.7-1.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_id": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jackson-modules-base@2.12.7-1.redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "product": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "product_id": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jettison@1.5.2-1.redhat_00002.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "product_id": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-undertow@2.2.22-1.SP3_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-remoting@5.0.27-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hal-console@3.3.16-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar@1.5.10-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-api@1.5.10-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-impl@1.5.10-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-common-spi@1.5.10-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-api@1.5.10-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-core-impl@1.5.10-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-deployers-common@1.5.10-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-jdbc@1.5.10-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-ironjacamar-validator@1.5.10-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsp-api_2.3_spec@2.0.0-3.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "product_id": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-sshd@2.9.2-1.redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-ejb-client@4.0.49-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "product_id": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-jsf-api_2.3_spec@3.0.0-6.SP07_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search@5.10.13-3.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-backend-jgroups@5.10.13-3.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-backend-jms@5.10.13-3.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-engine@5.10.13-3.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-orm@5.10.13-3.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-hibernate-search-serialization-avro@5.10.13-3.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron@1.15.16-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "product": { "name": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "product_id": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-elytron-tool@1.15.16-1.Final_redhat_00001.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "product": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "product_id": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration@1.10.0-24.Final_redhat_00023.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "product": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "product_id": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-cli@1.10.0-24.Final_redhat_00023.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "product": { "name": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "product_id": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-jboss-server-migration-core@1.10.0-24.Final_redhat_00023.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "product_id": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.4.9-4.GA_redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "product_id": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-javadocs@7.4.9-4.GA_redhat_00003.1.el9eap?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "product": { "name": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "product_id": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.4.9-4.GA_redhat_00003.1.el9eap?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src" }, "product_reference": "eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src" }, "product_reference": "eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src" }, "product_reference": "eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src" }, "product_reference": "eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src" }, "product_reference": "eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src" }, "product_reference": "eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src" }, "product_reference": "eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src" }, "product_reference": "eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src" }, "product_reference": "eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch" }, "product_reference": "eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch" }, "product_reference": "eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch" }, "product_reference": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src" }, "product_reference": "eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src" }, "product_reference": "eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src" }, "product_reference": "eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch" }, "product_reference": "eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch" }, "product_reference": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "relates_to_product_reference": "9Base-JBEAP-7.4" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src as a component of Red Hat JBoss EAP 7.4 for RHEL 9", "product_id": "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" }, "product_reference": "eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src", "relates_to_product_reference": "9Base-JBEAP-7.4" } ] }, "vulnerabilities": [ { "cve": "CVE-2015-9251", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2016-11-27T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1399546" } ], "notes": [ { "category": "description", "text": "jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting via cross-domain ajax requests", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2015-9251" }, { "category": "external", "summary": "RHBZ#1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2015-9251", "url": "https://www.cve.org/CVERecord?id=CVE-2015-9251" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2015-9251", "url": "https://nvd.nist.gov/vuln/detail/CVE-2015-9251" } ], "release_date": "2015-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Cross-site scripting via cross-domain ajax requests" }, { "cve": "CVE-2016-10735", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-01-09T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1668097" } ], "notes": [ { "category": "description", "text": "In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the data-target attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.\n\nRed Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2016-10735" }, { "category": "external", "summary": "RHBZ#1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2016-10735", "url": "https://www.cve.org/CVERecord?id=CVE-2016-10735" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735", "url": "https://nvd.nist.gov/vuln/detail/CVE-2016-10735" } ], "release_date": "2016-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: XSS in the data-target attribute" }, { "cve": "CVE-2017-18214", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2018-03-08T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1553413" } ], "notes": [ { "category": "description", "text": "The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.", "title": "Vulnerability description" }, { "category": "summary", "text": "nodejs-moment: Regular expression denial of service", "title": "Vulnerability summary" }, { "category": "other", "text": "This issue affects the versions of momentjs as shipped with Red Hat Enterprise Satellite 5. Red Hat Product Security has rated this issue as having security impact of Moderate. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.\n\nIn Quay 3.10 and above, no version of affected momentjs is present.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2017-18214" }, { "category": "external", "summary": "RHBZ#1553413", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553413" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2017-18214", "url": "https://www.cve.org/CVERecord?id=CVE-2017-18214" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2017-18214", "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-18214" } ], "release_date": "2017-09-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "version": "3.0" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "nodejs-moment: Regular expression denial of service" }, { "cve": "CVE-2018-14040", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601614" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14040" }, { "category": "external", "summary": "RHBZ#1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14040", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14040" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14040" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute" }, { "cve": "CVE-2018-14041", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601616" } ], "notes": [ { "category": "description", "text": "A flaw was found in Bootstrap, where it is vulnerable to Cross-site scripting, caused by improper validation of user-supplied input by the data-target property of scrollspy. This flaw allows a remote attacker to execute a script in a victim\u0027s Web browser within the security context of the hosting Web site, which can lead to stealing the victim\u0027s cookie-based authentication credentials.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14041" }, { "category": "external", "summary": "RHBZ#1601616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601616" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14041", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14041" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14041", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14041" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy" }, { "cve": "CVE-2018-14042", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2018-07-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1601617" } ], "notes": [ { "category": "description", "text": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite 6.2 and newer versions don\u0027t use the bootstrap library, hence are not affected by this flaw.\n\nRed Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation, since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.\n\nRed Hat Enterprise Satellite 5 is now in Maintenance Support 2 phase of the support and maintenance life cycle. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Satellite 5 Life Cycle: https://access.redhat.com/support/policy/updates/satellite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-14042" }, { "category": "external", "summary": "RHBZ#1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-14042", "url": "https://www.cve.org/CVERecord?id=CVE-2018-14042" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14042" } ], "release_date": "2018-05-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: Cross-site Scripting (XSS) in the data-container property of tooltip" }, { "cve": "CVE-2019-8331", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-02-20T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1686454" } ], "notes": [ { "category": "description", "text": "A cross-site scripting vulnerability was discovered in bootstrap. If an attacker could control the data given to tooltip or popover, they could inject HTML or Javascript into the rendered page when tooltip or popover events fired.", "title": "Vulnerability description" }, { "category": "summary", "text": "bootstrap: XSS in the tooltip or popover data-template attribute", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat CloudForms 4.6 and newer versions include the vulnerable component, but there is no risk of exploitation since there is no possible vector to access the vulnerability. Older Red Hat CloudForms versions don\u0027t use the vulnerable component at all.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-8331" }, { "category": "external", "summary": "RHBZ#1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-8331", "url": "https://www.cve.org/CVERecord?id=CVE-2019-8331" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8331" } ], "release_date": "2019-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.0" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "bootstrap: XSS in the tooltip or popover data-template attribute" }, { "cve": "CVE-2019-11358", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2019-03-28T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1701972" } ], "notes": [ { "category": "description", "text": "A Prototype Pollution vulnerability was found in jquery. Untrusted JSON passed to the `extend` function could lead to modifying objects up the prototype chain, including the global Object. A crafted JSON object passed to a vulnerable method could lead to denial of service or data injection, with various consequences.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Virtualization 4.2 EUS contains the affected version of bootstrap in the packages ovirt-js-dependencies and ovirt-engine-dashboard. These packages are deprecated in Red Hat Virtualization 4.3.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-11358" }, { "category": "external", "summary": "RHBZ#1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-11358", "url": "https://www.cve.org/CVERecord?id=CVE-2019-11358" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-11358" }, { "category": "external", "summary": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "url": "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/" }, { "category": "external", "summary": "https://www.drupal.org/sa-core-2019-006", "url": "https://www.drupal.org/sa-core-2019-006" } ], "release_date": "2019-03-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Prototype pollution in object\u0027s prototype leading to denial of service, remote code execution, or property injection" }, { "cve": "CVE-2020-11022", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-04-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1828406" } ], "notes": [ { "category": "description", "text": "A Cross-site scripting (XSS) vulnerability exists in JQuery. This flaw allows an attacker with the ability to supply input to the \u2018HTML\u2019 function to inject Javascript into the page where that input is rendered, and have it delivered by the browser.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method", "title": "Vulnerability summary" }, { "category": "other", "text": "No supported release of Red Hat OpenStack Platform is affected by this vulnerability as no shipped packages contain the vulnerable code.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11022" }, { "category": "external", "summary": "RHBZ#1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11022", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11022" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11022" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2", "url": "https://github.com/advisories/GHSA-gxr4-xjj5-5px2" } ], "release_date": "2020-04-23T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method" }, { "cve": "CVE-2020-11023", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2020-06-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1850004" } ], "notes": [ { "category": "description", "text": "A flaw was found in jQuery. HTML containing \\\u003coption\\\u003e elements from untrusted sources are passed, even after sanitizing, to one of jQuery\u0027s DOM manipulation methods, which may execute untrusted code. The highest threat from this vulnerability is to data confidentiality and integrity.", "title": "Vulnerability description" }, { "category": "summary", "text": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Enterprise Linux versions 6, 7, and 8 ship a vulnerable version of JQuery in the `pcs` component. As PCS does not accept untrusted input, the vulnerable code cannot be controlled by an attacker.\n\nMultiple Red Hat offerings use doxygen to build documentation. During this process an affected jquery.js file can be included in the resulting package. The \u0027gcc\u0027 and \u0027tbb\u0027 packages were potentially vulnerable via this method.\n\nOpenShift Container Platform 4 is not affected because even though it uses the \u0027gcc\u0027 component, vulnerable code is limited within the libstdc++-docs rpm package, which is not shipped.\n\nWithin regulated environments, a combination of the following controls acts as a significant barrier to successfully exploiting a CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027) vulnerability and therefore downgrades the severity of this particular CVE from Moderate to Low.\n\nStatic code analysis controls ensure that security flaws, including XSS vulnerabilities, are detected early in development by scanning code for improper input handling. This prevents vulnerable code from reaching production and encourages our developers to follow secure coding practices. System monitoring controls play a crucial role in detecting and responding to XSS attacks by analyzing logs, monitoring user behavior, and generating alerts for suspicious activity. Meanwhile, AWS WAF (Web Application Firewall) adds an extra layer of defense by filtering and blocking malicious input before it reaches the platform and/or application. Together, these controls create a defense-in-depth approach, reducing the risk of XSS exploitation by preventing, detecting, and mitigating attacks at multiple levels.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2020-11023" }, { "category": "external", "summary": "RHBZ#1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2020-11023", "url": "https://www.cve.org/CVERecord?id=CVE-2020-11023" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11023" }, { "category": "external", "summary": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/", "url": "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2020-04-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" }, { "category": "workaround", "details": "Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "exploit_status", "date": "2025-01-23T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Low" } ], "title": "jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM manipulation methods" }, { "cve": "CVE-2022-3143", "cwe": { "id": "CWE-208", "name": "Observable Timing Discrepancy" }, "discovery_date": "2022-09-06T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2124682" } ], "notes": [ { "category": "description", "text": "A flaw was found in Wildfly-elytron. Wildfly-elytron uses java.util.Arrays.equals in several places, which is unsafe and vulnerable to timing attacks. To compare values securely, use java.security.MessageDigest.isEqual instead. This flaw allows an attacker to access secure information or impersonate an authed user.", "title": "Vulnerability description" }, { "category": "summary", "text": "wildfly-elytron: possible timing attacks via use of unsafe comparator", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-3143" }, { "category": "external", "summary": "RHBZ#2124682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-3143", "url": "https://www.cve.org/CVERecord?id=CVE-2022-3143" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-3143", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-3143" } ], "release_date": "2022-09-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "wildfly-elytron: possible timing attacks via use of unsafe comparator" }, { "cve": "CVE-2022-40149", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-18T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135771" } ], "notes": [ { "category": "description", "text": "A stack-based buffer overflow vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. This flaw allows an attacker to supply content that causes the parser to crash by writing outside the memory bounds if the parser is running on user-supplied input, resulting in a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: parser crash by stackoverflow", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40149" }, { "category": "external", "summary": "RHBZ#2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40149", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40149" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40149" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: parser crash by stackoverflow" }, { "cve": "CVE-2022-40150", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2022-10-18T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135770" } ], "notes": [ { "category": "description", "text": "A vulnerability was found in Jettison, where parsing an untrusted XML or JSON data may lead to a crash. If the parser is running on user-supplied input, an attacker may supply content that causes the parser to crash, causing memory exhaustion. This effect may support a denial of service attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: memory exhaustion via user-supplied XML or JSON data", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40150" }, { "category": "external", "summary": "RHBZ#2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40150", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40150" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40150" }, { "category": "external", "summary": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1", "url": "https://github.com/jettison-json/jettison/releases/tag/jettison-1.5.1" } ], "release_date": "2022-09-20T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "jettison: memory exhaustion via user-supplied XML or JSON data" }, { "cve": "CVE-2022-40152", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-10-13T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2134291" } ], "notes": [ { "category": "description", "text": "A flaw was found in the FasterXML/woodstox package. This flaw allows an attacker to cause a denial of service (DoS) in its target via XML serialization. An attacker may benefit from the parser sending a malicious input that may cause a crash. This vulnerability is only relevant for users using the DTD parsing functionality.", "title": "Vulnerability description" }, { "category": "summary", "text": "woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-40152" }, { "category": "external", "summary": "RHBZ#2134291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134291" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-40152", "url": "https://www.cve.org/CVERecord?id=CVE-2022-40152" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-40152", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40152" }, { "category": "external", "summary": "https://github.com/advisories/GHSA-3f7h-mf4q-vrm4", "url": "https://github.com/advisories/GHSA-3f7h-mf4q-vrm4" } ], "release_date": "2022-09-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "woodstox-core: woodstox to serialise XML data was vulnerable to Denial of Service attacks" }, { "cve": "CVE-2022-42003", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135244" } ], "notes": [ { "category": "description", "text": "A flaw was found in FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion when the UNWRAP_SINGLE_VALUE_ARRAYS feature is enabled due to unchecked primitive value deserializers to avoid deep wrapper array nesting.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42003" }, { "category": "external", "summary": "RHBZ#2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42003", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42003" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42003" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS" }, { "cve": "CVE-2022-42004", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-10-17T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2135247" } ], "notes": [ { "category": "description", "text": "A flaw was found In FasterXML jackson-databind. This issue could allow an attacker to benefit from resource exhaustion due to the lack of a check in BeanDeserializer._deserializeFromArray to prevent the use of deeply nested arrays. An application is only vulnerable with certain customized choices for deserialization.", "title": "Vulnerability description" }, { "category": "summary", "text": "jackson-databind: use of deeply nested arrays", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-42004" }, { "category": "external", "summary": "RHBZ#2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-42004", "url": "https://www.cve.org/CVERecord?id=CVE-2022-42004" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-42004" } ], "release_date": "2022-10-02T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jackson-databind: use of deeply nested arrays" }, { "cve": "CVE-2022-45047", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2022-11-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2145194" } ], "notes": [ { "category": "description", "text": "A flaw was found in Apache MINA SSHD, when using Java deserialization to load a serialized java.security.PrivateKey. An attacker could benefit from unsafe deserialization by inserting unsecured data that may affect the application or server.", "title": "Vulnerability description" }, { "category": "summary", "text": "mina-sshd: Java unsafe deserialization vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Impact as High as there\u0027s a mitigation for minimizing the impact which the flaw requires org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to be impacted, which would require an external/public API for an attacker to benefit from it. \n\nRed Hat Fuse 7 and Red Hat JBoss Enterprise Application Platform 7 have a lower rate (moderate) as it\u0027s very unlikely to be exploited since those are for internal usage or use a custom implementation in their case.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45047" }, { "category": "external", "summary": "RHBZ#2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45047", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45047" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45047" }, { "category": "external", "summary": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html", "url": "https://www.mail-archive.com/dev@mina.apache.org/msg39312.html" } ], "release_date": "2022-11-16T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" }, { "category": "workaround", "details": "From the maintainer:\n\nFor Apache MINA SSHD \u003c= 2.9.1, do not use org.apache.sshd.server.keyprovider.SimpleGeneratorHostKeyProvider to generate and later load your server\u0027s host key. Use separately generated host key files, for instance in OpenSSH format, and load them via a org.apache.sshd.common.keyprovider.FileKeyPairProvider instead. Or use a custom implementation instead of \nSimpleGeneratorHostKeyProvider that uses the OpenSSH format for storing and loading the host key (via classes OpenSSHKeyPairResourceWriter and OpenSSHKeyPairResourceParser).", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "mina-sshd: Java unsafe deserialization vulnerability" }, { "cve": "CVE-2022-45693", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "discovery_date": "2022-12-23T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155970" } ], "notes": [ { "category": "description", "text": "A flaw was found in Jettison, where it is vulnerable to a denial of service caused by a stack-based buffer overflow. By sending a specially-crafted request using the map parameter, a remote attacker can cause a denial of service.", "title": "Vulnerability description" }, { "category": "summary", "text": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat has determined the impact of this flaw to be Moderate; a successful attack using this flaw would require the processing of untrusted, unsanitized, or unrestricted user inputs, which runs counter to established Red Hat security practices.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src" ], "known_not_affected": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-45693" }, { "category": "external", "summary": "RHBZ#2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-45693", "url": "https://www.cve.org/CVERecord?id=CVE-2022-45693" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45693" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos" }, { "cve": "CVE-2022-46364", "cwe": { "id": "CWE-918", "name": "Server-Side Request Forgery (SSRF)" }, "discovery_date": "2022-12-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "2155682" } ], "notes": [ { "category": "description", "text": "A SSRF vulnerability was found in Apache CXF. This issue occurs when parsing the href attribute of XOP:Include in MTOM requests, allowing an attacker to perform SSRF style attacks on webservices that take at least one parameter of any type.", "title": "Vulnerability description" }, { "category": "summary", "text": "CXF: SSRF Vulnerability", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Integration Camel Quarkus does not support CXF extensions and so is affected at a reduced impact of Moderate.\nThe RHSSO server does not ship Apache CXF. The component mentioned in CVE-2022-46364 is a transitive dependency coming from Fuse adapters and the test suite.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2022-46364" }, { "category": "external", "summary": "RHBZ#2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2022-46364", "url": "https://www.cve.org/CVERecord?id=CVE-2022-46364" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364", "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46364" }, { "category": "external", "summary": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2", "url": "https://cxf.apache.org/security-advisories.data/CVE-2022-46364.txt?version=1\u0026modificationDate=1670944472739\u0026api=v2" } ], "release_date": "2022-12-13T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2023-01-31T13:15:23+00:00", "details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258", "product_ids": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2023:0554" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-apache-sshd-0:2.9.2-1.redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-elytron-web-0:1.9.3-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hal-console-0:3.3.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-0:5.10.13-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jgroups-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-backend-jms-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-engine-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-orm-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-hibernate-search-serialization-avro-0:5.10.13-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-0:1.5.10-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-ironjacamar-common-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-common-spi-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-api-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-core-impl-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-deployers-common-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-jdbc-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-ironjacamar-validator-0:1.5.10-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-annotations-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-core-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-databind-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-datatype-jdk8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-datatype-jsr310-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-json-provider-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-jaxrs-providers-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-module-jaxb-annotations-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-base-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jackson-modules-java8-0:2.12.7-1.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-0:1.0.1-3.redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-javaee-security-soteria-enterprise-0:1.0.1-3.redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-ejb-client-0:4.0.49-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsf-api_2.3_spec-0:3.0.0-6.SP07_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-jsp-api_2.3_spec-0:2.0.0-3.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-remoting-0:5.0.27-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-0:1.10.0-24.Final_redhat_00023.1.el9eap.src", "9Base-JBEAP-7.4:eap7-jboss-server-migration-cli-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jboss-server-migration-core-0:1.10.0-24.Final_redhat_00023.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-jettison-0:1.5.2-1.redhat_00002.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-undertow-0:2.2.22-1.SP3_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-undertow-server-0:1.9.3-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-0:7.4.9-4.GA_redhat_00003.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-elytron-0:1.15.16-1.Final_redhat_00001.1.el9eap.src", "9Base-JBEAP-7.4:eap7-wildfly-elytron-tool-0:1.15.16-1.Final_redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-javadocs-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-wildfly-modules-0:7.4.9-4.GA_redhat_00003.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.noarch", "9Base-JBEAP-7.4:eap7-woodstox-core-0:6.4.0-1.redhat_00001.1.el9eap.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "CXF: SSRF Vulnerability" } ] }
RHSA-2023:0554
Vulnerability from csaf_redhat
Published
2023-01-31 13:15
Modified
2025-07-10 20:17
Summary
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
Notes
Topic
An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 9.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.
Security Fix(es):
* jquery: Prototype pollution in object's prototype leading to denial of
service, remote code execution, or property injection (CVE-2019-11358)
* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)
* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute
(CVE-2018-14040)
* jquery: Untrusted code execution via <option> tag in HTML passed to DOM
manipulation methods (CVE-2020-11023)
* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method
(CVE-2020-11022)
* bootstrap: XSS in the data-target attribute (CVE-2016-10735)
* bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy
(CVE-2018-14041)
* sshd-common: mina-sshd: Java unsafe deserialization vulnerability
(CVE-2022-45047)
* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of
Service attacks (CVE-2022-40152)
* bootstrap: Cross-site Scripting (XSS) in the data-container property of
tooltip (CVE-2018-14042)
* bootstrap: XSS in the tooltip or popover data-template attribute
(CVE-2019-8331)
* nodejs-moment: Regular expression denial of service (CVE-2017-18214)
* wildfly-elytron: possible timing attacks via use of unsafe comparator
(CVE-2022-3143)
* jackson-databind: use of deeply nested arrays (CVE-2022-42004)
* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS
(CVE-2022-42003)
* jettison: parser crash by stackoverflow (CVE-2022-40149)
* jettison: memory exhaustion via user-supplied XML or JSON data
(CVE-2022-40150)
* jettison: If the value in map is the map's self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)
* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat JBoss Enterprise Application Platform 7.4 for Red Hat Enterprise Linux 9.\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform 7.4.9 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.4.8, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.4.9 Release Notes for information about the most significant bug fixes and enhancements included in this release.\n\nSecurity Fix(es):\n\n* jquery: Prototype pollution in object\u0027s prototype leading to denial of\nservice, remote code execution, or property injection (CVE-2019-11358)\n\n* jquery: Cross-site scripting via cross-domain ajax requests (CVE-2015-9251)\n\n* bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute\n(CVE-2018-14040)\n\n* jquery: Untrusted code execution via \u003coption\u003e tag in HTML passed to DOM\nmanipulation methods (CVE-2020-11023)\n\n* jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method\n(CVE-2020-11022)\n\n* bootstrap: XSS in the data-target attribute (CVE-2016-10735)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-target property of scrollspy\n(CVE-2018-14041)\n\n* sshd-common: mina-sshd: Java unsafe deserialization vulnerability\n(CVE-2022-45047)\n\n* woodstox-core: woodstox to serialise XML data was vulnerable to Denial of\nService attacks (CVE-2022-40152)\n\n* bootstrap: Cross-site Scripting (XSS) in the data-container property of\ntooltip (CVE-2018-14042)\n\n* bootstrap: XSS in the tooltip or popover data-template attribute\n(CVE-2019-8331)\n\n* nodejs-moment: Regular expression denial of service (CVE-2017-18214)\n\n* wildfly-elytron: possible timing attacks via use of unsafe comparator\n(CVE-2022-3143)\n\n* jackson-databind: use of deeply nested arrays (CVE-2022-42004)\n\n* jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS\n(CVE-2022-42003)\n\n* jettison: parser crash by stackoverflow (CVE-2022-40149)\n\n* jettison: memory exhaustion via user-supplied XML or JSON data\n(CVE-2022-40150)\n\n* jettison: If the value in map is the map\u0027s self, the new new JSONObject(map) cause StackOverflowError which may lead to dos (CVE-2022-45693)\n\n* CXF: Apache CXF: SSRF Vulnerability (CVE-2022-46364)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2023:0554", "url": "https://access.redhat.com/errata/RHSA-2023:0554" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/" }, { "category": "external", "summary": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/", "url": "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.4/html-single/installation_guide/" }, { "category": "external", "summary": "1399546", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1399546" }, { "category": "external", "summary": "1553413", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1553413" }, { "category": "external", "summary": "1601614", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601614" }, { "category": "external", "summary": "1601616", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601616" }, { "category": "external", "summary": "1601617", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1601617" }, { "category": "external", "summary": "1668097", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1668097" }, { "category": "external", "summary": "1686454", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686454" }, { "category": "external", "summary": "1701972", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1701972" }, { "category": "external", "summary": "1828406", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1828406" }, { "category": "external", "summary": "1850004", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1850004" }, { "category": "external", "summary": "2124682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2124682" }, { "category": "external", "summary": "2134291", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2134291" }, { "category": "external", "summary": "2135244", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135244" }, { "category": "external", "summary": "2135247", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135247" }, { "category": "external", "summary": "2135770", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135770" }, { "category": "external", "summary": "2135771", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2135771" }, { "category": "external", "summary": "2145194", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2145194" }, { "category": "external", "summary": "2155682", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155682" }, { "category": "external", "summary": "2155970", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2155970" }, { "category": "external", "summary": "JBEAP-23864", "url": "https://issues.redhat.com/browse/JBEAP-23864" }, { "category": "external", "summary": "JBEAP-23865", "url": "https://issues.redhat.com/browse/JBEAP-23865" }, { "category": "external", "summary": "JBEAP-23866", "url": "https://issues.redhat.com/browse/JBEAP-23866" }, { "category": "external", "summary": "JBEAP-23928", "url": "https://issues.redhat.com/browse/JBEAP-23928" }, { "category": "external", "summary": "JBEAP-24055", "url": "https://issues.redhat.com/browse/JBEAP-24055" }, { "category": "external", "summary": "JBEAP-24081", "url": "https://issues.redhat.com/browse/JBEAP-24081" }, { "category": "external", "summary": "JBEAP-24095", "url": "https://issues.redhat.com/browse/JBEAP-24095" }, { "category": "external", "summary": "JBEAP-24100", "url": "https://issues.redhat.com/browse/JBEAP-24100" }, { "category": "external", "summary": "JBEAP-24127", "url": "https://issues.redhat.com/browse/JBEAP-24127" }, { "category": "external", "summary": "JBEAP-24128", "url": "https://issues.redhat.com/browse/JBEAP-24128" }, { "category": "external", "summary": "JBEAP-24132", "url": "https://issues.redhat.com/browse/JBEAP-24132" }, { "category": "external", "summary": "JBEAP-24147", "url": "https://issues.redhat.com/browse/JBEAP-24147" }, { "category": "external", "summary": "JBEAP-24167", "url": "https://issues.redhat.com/browse/JBEAP-24167" }, { "category": "external", "summary": "JBEAP-24191", "url": "https://issues.redhat.com/browse/JBEAP-24191" }, { "category": "external", "summary": "JBEAP-24195", "url": "https://issues.redhat.com/browse/JBEAP-24195" }, { "category": "external", "summary": "JBEAP-24207", "url": "https://issues.redhat.com/browse/JBEAP-24207" }, { "category": "external", "summary": "JBEAP-24248", "url": "https://issues.redhat.com/browse/JBEAP-24248" }, { "category": "external", "summary": "JBEAP-24426", "url": "https://issues.redhat.com/browse/JBEAP-24426" }, { "category": "external", "summary": "JBEAP-24427", "url": "https://issues.redhat.com/browse/JBEAP-24427" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_0554.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.4.9 Security update", "tracking": { "current_release_date": "2025-07-10T20:17:32+00:00", "generator": { "date": "2025-07-10T20:17:32+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.6.3" } }, "id": "RHSA-2023:0554", "initial_release_date": "2023-01-31T13:15:23+00:00", "revision_history": [ { "date": "2023-01-31T13:15:23+00:00", "number": "1", "summary": "Initial version" }, { "date": "2023-01-31T13:15:23+00:00", "number": "2",