Important: pki-deps:10.6 security update

2019-09-1015:32:49

errata.almalinux.org

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

5.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

0.533 Medium

EPSS

Percentile

97.6%

JSON

The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-core module by AlmaLinux Certificate System.

Security Fix(es):

jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution (CVE-2019-12384)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux8noarchxmlstreambuffer< 1.5.4-8.module_el8.5.0+2577+9e95fe00xmlstreambuffer-1.5.4-8.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux8noarchjakarta-commons-httpclient< 3.1-28.module_el8.5.0+2577+9e95fe00jakarta-commons-httpclient-3.1-28.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux8noarchglassfish-jaxb-txw2< 2.2.11-11.module_el8.5.0+2577+9e95fe00glassfish-jaxb-txw2-2.2.11-11.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux8noarchjackson-jaxrs-json-provider< 2.9.9-1.module_el8.5.0+2577+9e95fe00jackson-jaxrs-json-provider-2.9.9-1.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux8noarchrelaxngdatatype< 2011.1-7.module_el8.5.0+2577+9e95fe00relaxngDatatype-2011.1-7.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux8noarchapache-commons-collections< 3.2.2-10.module_el8.5.0+2577+9e95fe00apache-commons-collections-3.2.2-10.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux8noarchjavassist< 3.18.1-8.module_el8.5.0+2577+9e95fe00javassist-3.18.1-8.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux8noarchxml-commons-resolver< 1.2-26.module_el8.5.0+2577+9e95fe00xml-commons-resolver-1.2-26.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux8noarchxerces-j2< 2.11.0-34.module_el8.5.0+2577+9e95fe00xerces-j2-2.11.0-34.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux8noarchvelocity< 1.7-24.module_el8.5.0+2577+9e95fe00velocity-1.7-24.module_el8.5.0+2577+9e95fe00.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	8	noarch	xmlstreambuffer	< 1.5.4-8.module_el8.5.0+2577+9e95fe00	xmlstreambuffer-1.5.4-8.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux	8	noarch	jakarta-commons-httpclient	< 3.1-28.module_el8.5.0+2577+9e95fe00	jakarta-commons-httpclient-3.1-28.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux	8	noarch	glassfish-jaxb-txw2	< 2.2.11-11.module_el8.5.0+2577+9e95fe00	glassfish-jaxb-txw2-2.2.11-11.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux	8	noarch	jackson-jaxrs-json-provider	< 2.9.9-1.module_el8.5.0+2577+9e95fe00	jackson-jaxrs-json-provider-2.9.9-1.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux	8	noarch	relaxngdatatype	< 2011.1-7.module_el8.5.0+2577+9e95fe00	relaxngDatatype-2011.1-7.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux	8	noarch	apache-commons-collections	< 3.2.2-10.module_el8.5.0+2577+9e95fe00	apache-commons-collections-3.2.2-10.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux	8	noarch	javassist	< 3.18.1-8.module_el8.5.0+2577+9e95fe00	javassist-3.18.1-8.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux	8	noarch	xml-commons-resolver	< 1.2-26.module_el8.5.0+2577+9e95fe00	xml-commons-resolver-1.2-26.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux	8	noarch	xerces-j2	< 2.11.0-34.module_el8.5.0+2577+9e95fe00	xerces-j2-2.11.0-34.module_el8.5.0+2577+9e95fe00.noarch.rpm
almalinux	8	noarch	velocity	< 1.7-24.module_el8.5.0+2577+9e95fe00	velocity-1.7-24.module_el8.5.0+2577+9e95fe00.noarch.rpm