Описание
ELSA-2026-43218: pki-deps:10.6 security update (IMPORTANT)
apache-commons-collections [3.2.2-10]
[3.2.2-9]
- Remove workaround for symlink->directory rpm bug
[3.2.2-8]
- Allow testframework to still be built even with tests disabled, which is needed by other packages
[3.2.2-7]
[3.2.2-6]
- Temporarly disable running tests
[3.2.2-5]
[3.2.2-4]
[3.2.2-3]
- Add workaround for symlink->directory rpm bug
[3.2.2-2]
[3.2.2-1]
- Update to upstream version 3.2.2
- Merge two javadoc subpackages
- Install with XMVn
- Specfile cleanup
apache-commons-lang [2.6-21]
[2.6-20]
[2.6-19]
[2.6-18]
[2.6-17]
[2.6-16]
[2.6-15]
- Drop old jakarta provides/obsoletes.
[2.6-14]
- Use Requires: java-headless rebuild (#1067528)
[2.6-13]
[2.6-12]
- Rebuild
apache-commons-net [3.6-3]
[3.6-2]
[3.6-1]
- Update to upstream version 3.6
[3.5-2]
[3.5-1]
- Update to upstream version 3.5
[3.4-3]
[3.4-2]
- Add workaround for suprious test failure (NET-586)
[3.4-1]
- Update to upstream version 3.4
[3.3-7]
- Disable failing test
[3.3-6]
bea-stax [1.2.0-16]
[1.2.0-15]
[1.2.0-14]
- Install with XMvn
[1.2.0-13]
[1.2.0-12]
[1.2.0-11]
[1.2.0-10]
[1.2.0-9]
- Use .mfiles generated during build
[1.2.0-8]
[1.2.0-7]
glassfish-fastinfoset [1.2.13-9]
- Regenerate BRs
[1.2.13-8]
[1.2.13-7]
[1.2.13-6]
[1.2.13-5]
- add missing build requires
[1.2.13-4]
[1.2.13-3]
[1.2.13-2]
- introduce license macro
[1.2.13-1]
- update to 1.2.13
- Fix URL
- Add license text
[1.2.12-11]
glassfish-jaxb [2.2.11-12]
- Update requiremnts to avoid conflicts with jaxb module packages
[2.2.11-11]
- Avoid dependencies on msv and glassfish-dtd-parser
[2.2.11-10]
- Disable TXW2 compiler module
[2.2.11-9]
- Reduce build deps
[2.2.11-8]
[2.2.11-7]
- Specify CDDL license version
[2.2.11-6]
[2.2.11-5]
[2.2.11-4]
[2.2.11-3]
glassfish-jaxb-api [2.2.12-8]
[2.2.12-7]
[2.2.12-6]
[2.2.12-5]
- Regenerate BRs
[2.2.12-4]
[2.2.12-3]
[2.2.12-2]
- Update to 2.2.12-b141001.1542
[2.2.12-1]
- Update to 2.2.12
[2.2.9-6]
[2.2.9-5]
- Use Requires: java-headless rebuild (#1067528)
jackson-annotations [2.21-1]
- Rebase to version 2.21
- Resolves: RHEL-188291
jackson-core [2.21.4-1]
- Rebase to version 2.21.4
- Resolves: RHEL-188291
jackson-databind [2.21.4-1]
- Rebase to upstream version 2.21.4
- Resolves: RHEL-188291
jackson-jaxrs-providers [2.21.4-1]
- Rebase to upstream version 2.21.4
- Resolves: RHEL-188291
jackson-modules-base [2.21.4-1]
- Update to version 2.21.4
- Resolves: RHEL-188291
jakarta-commons-httpclient [1:3.1-28]
[1:3.1-27]
[1:3.1-26]
- Use build-jar-repository for locating dependencies
[1:3.1-25]
[1:3.1-24]
[1:3.1-23]
- Respect configured SO_TIMEOUT during SSL handshake
- Resolves: CVE-2015-5262
[1:3.1-22]
[1:3.1-21]
- Remove legacy Obsoletes/Provides
[1:3.1-20]
- Fix MITM security vulnerability
- Resolves: CVE-2014-3577
[1:3.1-19]
- Add alias for apache:commons-httpclient
javassist [3.18.1-8]
[3.18.1-7]
[3.18.1-6]
[3.18.1-5]
[3.18.1-4]
[3.18.1-3]
- Simplify build dependencies
[3.18.1-2]
[3.18.1-1]
- Update to upstream version 3.18.1
- Remove workaround for rpm bug, can be removed in F-18
- Update to current packaging guidelines
[3.16.1-7]
- Use Requires: java-headless rebuild (#1067528)
[3.16.1-6]
pki-servlet-engine [1:9.0.62-1]
- Bump version number to avoid conflicts with tomcat
[1:9.0.30-4]
- Convert pki-servlet-engine into an alias for tomcat
[1:9.0.30-3]
- Reverts: rhbz#1969366 as it causes other issues
[1:9.0.30-2]
- Resolves: rhbz#1969366 CA instance installation fails with error message
[1:9.0.30-1]
- Resolves: rhbz#1721684 Rebase pki-servlet-engine to 9.0.30
- Update to JWS 5.3.0 distribution
- Remove new dependencies that PKI doesn't need (and are not provided by RHEL 8)
[1:9.0.7-16]
- Obsoleted pki-servlet-container
[1:9.0.7-15]
- Rename pki-servlet-container into pki-servlet-engine
[1:9.0.7-14]
- Update to JWS 5.0.2 distribution
- Resolves: rhbz#1658846 CVE-2018-8034 pki-servlet-container: tomcat: host name verification missing in WebSocket client
- Resolves: rhbz#1579614 CVE-2018-8014 pki-servlet-container: tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
- Resolves: rhbz#1619232 - CVE-2018-8037 pki-servlet-container: tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up
- Resolves: rhbz#1641874 - CVE-2018-11784 pki-servlet-container: tomcat: Open redirect in default servlet
[1:9.0.7-13]
- Reinstate Maven artifacts and fix maven-metadata JAR path
[1:9.0.7-12]
- Add missing BuildRequires: systemd-units
relaxngDatatype [2011.1-7]
[2011.1-6]
[2011.1-5]
[2011.1-4]
- Add missing build-requires
[2011.1-3]
[2011.1-2]
[2011.1-1]
- Update to version released from new project location rhbz#981275
- Build/install with maven instead of ant
- Drop old javadoc rpm bug workaround
[1.0-12.5]
[1.0-11.5]
[1.0-10.5]
- Install license file with javadoc package
- Convert versioned javadoc to versionless
- Update to current packaging guidelines
- Remove msv provides and obsoletes
slf4j [0:1.7.25-4]
- Disallow EventData deserialization by default (CVE-2018-8088)
- Resolves rhbz#1549928
[0:1.7.25-3]
[0:1.7.25-2]
[0:1.7.25-1]
- Update to upstream version 1.7.25
[0:1.7.22-4]
- Avoid absolute paths
[0:1.7.22-3]
- Avoid literal carriage return
- Remove Group tag
[0:1.7.22-2]
[0:1.7.22-1]
- Update to upstream version 1.7.22
[0:1.7.21-4]
- Install source JARs in separate package
[0:1.7.21-3]
- Remove build-requires on perl
stax-ex [1.7.7-8]
[1.7.7-7]
[1.7.7-6]
[1.7.7-5]
- regenerate build-requires
[1.7.7-4]
[1.7.7-3]
[1.7.7-2]
- introduce license macro
[1.7.7-1]
- update to 1.7.7
[1.7.1-8]
[1.7.1-7]
- Use Requires: java-headless rebuild (#1067528)
velocity [0:1.7-24]
- Repack the tarball without binaries
[0:1.7-23]
[0:1.7-22]
[0:1.7-21]
[0:1.7-20]
- Add hsqldb conditional
- Switch to glassfish-servlet-api
[0:1.7-19]
[0:1.7-18]
- fix FTBFS rhbz#1240035
- fix BR list, change log4j with log4j12
- set javac source/target to 1.6
- disable Java8doc doclint
- remove werken-xpath Import/Export refences in manifest file
- resolve some rpmlint problems
- remove zero-length file
- introduce license macro
[0:1.7-17]
[0:1.7-16]
- Update to current packaging guidelines
[0:1.7-15]
- Require hsqldb-lib instead of hsqldb
xalan-j2 [0:2.7.1-38]
- Update license of subpackages
[0:2.7.1-37]
- Remove BR on xml-stylebook
[0:2.7.1-36]
- Repack the tarball without binaries
[0:2.7.1-35]
[0:2.7.1-34]
[0:2.7.1-33]
- Elimitate race condition when injecting JAR manifest
- Resolves: rhbz#1495250
[0:2.7.1-32]
[0:2.7.1-31]
- Fix missing jaxp_transformer_impl symlink after upgrade
[0:2.7.1-30]
- Install with XMvn
- Remove alternatives
[0:2.7.1-29]
- Build against glassfish-servlet-api
xerces-j2 [2.11.0-34]
- Fix license tag to include W3C
[2.11.0-33]
- Add requirement on javapackages-tools since scripts use java-functions.
[2.11.0-32]
[2.11.0-31]
[2.11.0-30]
- Remove unneeded dependency on dejavu-sans-fonts
[2.11.0-29]
[2.11.0-28]
- Fix missing jaxp_parser_impl symlink after upgrade
[2.11.0-27]
- Remove alternatives, there is no other provider
- Specfile cleanup
[2.11.0-26]
- Install with XMvn
[2.11.0-25]
xml-commons-apis [1.4.01-25]
[1.4.01-24]
- Elimitate race condition when injecting JAR manifest
- Resolves: rhbz#1495249
[1.4.01-23]
[1.4.01-22]
- Update to current packaging guidelines
[1.4.01-21]
[1.4.01-20]
[1.4.01-19]
[1.4.01-18]
[1.4.01-17]
- Don't generate duplicate Maven metadata
[1.4.01-16]
- Use .mfiles generated during build
xml-commons-resolver [0:1.2-26]
- Add requirement on javapackages-tools since scripts use java-functions.
[0:1.2-25]
[0:1.2-24]
[0:1.2-23]
[0:1.2-22]
- Update to current packaging guidelines
[0:1.2-21]
- Fix rpm conditional
[0:1.2-20]
[0:1.2-19]
[0:1.2-18]
[0:1.2-17]
- Fix FTBFS.
xmlstreambuffer [1.5.4-8]
- Avoid test dependencies
[1.5.4-7]
[1.5.4-6]
[1.5.4-5]
[1.5.4-4]
- add missing build requires: maven-plugin-bundle
[1.5.4-3]
[1.5.4-2]
[1.5.4-1]
- update to 1.5.4
- introduce license macro
[1.5.1-5]
[1.5.1-4]
- Use Requires: java-headless rebuild (#1067528)
xsom [0-19.20110809svn]
[0-18.20110809svn]
- Specify CDDL license version
[0-17.20110809svn]
[0-16.20110809svn]
[0-15.20110809svn]
[0-14.20110809svn]
- Fix FTBFS
[0-13.20110809svn]
[0-12.20110809svn]
- Fix junit BRs (#1107359)
- Fix FTBFS due to F21 XMvn changes
[0-11.20110809svn]
[0-10.20110809svn]
Обновленные пакеты
Oracle Linux 8
Oracle Linux aarch64
Module pki-deps:10.6 is enabled
velocity
1.7-24.module+el8.10.0+90642+1ede0e5a
xml-commons-resolver
1.2-26.module+el8.10.0+90642+1ede0e5a
apache-commons-collections
3.2.2-10.module+el8.10.0+90642+1ede0e5a
apache-commons-net
3.6-3.module+el8.10.0+90642+1ede0e5a
pki-servlet-engine
9.0.62-1.module+el8.10.0+90642+1ede0e5a
xsom
0-19.20110809svn.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-core
2.2.11-12.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-txw2
2.2.11-12.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-runtime
2.2.11-12.module+el8.10.0+90642+1ede0e5a
xerces-j2
2.11.0-34.module+el8.10.0+90642+1ede0e5a
jackson-core
2.21.4-1.module+el8.10.0+90972+fe199724
jackson-annotations
2.21-1.module+el8.10.0+90972+fe199724
jackson-jaxrs-providers
2.21.4-1.module+el8.10.0+90972+fe199724
jackson-databind
2.21.4-1.module+el8.10.0+90972+fe199724
jackson-module-jaxb-annotations
2.21.4-2.module+el8.10.0+90972+fe199724
jackson-jaxrs-json-provider
2.21.4-1.module+el8.10.0+90972+fe199724
bea-stax-api
1.2.0-16.module+el8.10.0+90682+879b1f6e
glassfish-jaxb-api
2.2.12-8.module+el8.10.0+90682+879b1f6e
javassist
3.18.1-8.module+el8.10.0+90682+879b1f6e
xml-commons-apis
1.4.01-25.module+el8.10.0+90682+879b1f6e
slf4j-jdk14
1.7.25-4.module+el8.10.0+90682+879b1f6e
stax-ex
1.7.7-8.module+el8.10.0+90682+879b1f6e
javassist-javadoc
3.18.1-8.module+el8.10.0+90682+879b1f6e
slf4j
1.7.25-4.module+el8.10.0+90682+879b1f6e
apache-commons-lang
2.6-21.module+el8.10.0+90682+879b1f6e
jakarta-commons-httpclient
3.1-28.module+el8.10.0+90682+879b1f6e
xalan-j2
2.7.1-38.module+el8.10.0+90682+879b1f6e
glassfish-fastinfoset
1.2.13-9.module+el8.10.0+90682+879b1f6e
relaxngDatatype
2011.1-7.module+el8.10.0+90682+879b1f6e
xmlstreambuffer
1.5.4-8.module+el8.10.0+90682+879b1f6e
Oracle Linux x86_64
Module pki-deps:10.6 is enabled
jackson-core
2.21.4-1.module+el8.10.0+90972+fe199724
jackson-module-jaxb-annotations
2.21.4-2.module+el8.10.0+90972+fe199724
jackson-jaxrs-json-provider
2.21.4-1.module+el8.10.0+90972+fe199724
jackson-databind
2.21.4-1.module+el8.10.0+90972+fe199724
jackson-jaxrs-providers
2.21.4-1.module+el8.10.0+90972+fe199724
jackson-annotations
2.21-1.module+el8.10.0+90972+fe199724
pki-servlet-engine
9.0.62-1.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-runtime
2.2.11-12.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-txw2
2.2.11-12.module+el8.10.0+90642+1ede0e5a
xml-commons-resolver
1.2-26.module+el8.10.0+90642+1ede0e5a
xsom
0-19.20110809svn.module+el8.10.0+90642+1ede0e5a
glassfish-jaxb-core
2.2.11-12.module+el8.10.0+90642+1ede0e5a
apache-commons-collections
3.2.2-10.module+el8.10.0+90642+1ede0e5a
xerces-j2
2.11.0-34.module+el8.10.0+90642+1ede0e5a
apache-commons-net
3.6-3.module+el8.10.0+90642+1ede0e5a
velocity
1.7-24.module+el8.10.0+90642+1ede0e5a
javassist
3.18.1-8.module+el8.10.0+90682+879b1f6e
bea-stax-api
1.2.0-16.module+el8.10.0+90682+879b1f6e
glassfish-fastinfoset
1.2.13-9.module+el8.10.0+90682+879b1f6e
stax-ex
1.7.7-8.module+el8.10.0+90682+879b1f6e
relaxngDatatype
2011.1-7.module+el8.10.0+90682+879b1f6e
javassist-javadoc
3.18.1-8.module+el8.10.0+90682+879b1f6e
jakarta-commons-httpclient
3.1-28.module+el8.10.0+90682+879b1f6e
slf4j-jdk14
1.7.25-4.module+el8.10.0+90682+879b1f6e
slf4j
1.7.25-4.module+el8.10.0+90682+879b1f6e
xalan-j2
2.7.1-38.module+el8.10.0+90682+879b1f6e
apache-commons-lang
2.6-21.module+el8.10.0+90682+879b1f6e
glassfish-jaxb-api
2.2.12-8.module+el8.10.0+90682+879b1f6e
xml-commons-apis
1.4.01-25.module+el8.10.0+90682+879b1f6e
xmlstreambuffer
1.5.4-8.module+el8.10.0+90682+879b1f6e
Связанные CVE
Связанные уязвимости
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
jackson-databind contains the general-purpose data-binding functionali ...
