Read the docs
Red Hat Security Advisory

RHSA-2019:1822

Red Hat Decision Manager 7.4.0 Security Update

Released 2019-07-22 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 11 records

TI-2019-07494 CVE-2019-10173 · GHSA-hf23-9pf7-388p

Code injection in xstream

Priority CRITICAL 86

It was found that xstream API version 1.4.10 before 1.4.11 introduced a regression for a previous deserialization flaw.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.95036 Published 2019-07-23 Fixed in 1.4.11 CWE-94
TI-2018-10571 CVE-2018-14719 · GHSA-4gq5-ch57-c2mg

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute…

Priority MEDIUM 61

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.09682 Published 2019-01-02 Partial fix · 2.9.7, 2.8.11.3 +1 CWE-502
TI-2018-10573 CVE-2018-14721 · GHSA-9mxf-g3x6-wv74

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct…

Priority MEDIUM 56

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

CVSS 3.0CRITICAL 10.0 Network No auth No interaction EPSS 0.10458 Published 2019-01-02 Partial fix · 2.9.7, 2.8.11.3 +1 CWE-918
TI-2018-10572 CVE-2018-14720 · GHSA-x2w5-5m2g-7h5m

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML…

Priority MEDIUM 52

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.07524 Published 2019-01-02 Partial fix · 2.9.7, 2.8.11.3 +1 CWE-502