Red Hat Security Advisory

RHSA-2019:2998

Red Hat OpenShift Application Runtimes Thorntail 2.5.0 security & bug fix update

Released 2019-10-10 · Red Hat rating Important · View on Red Hat →

Fixed in

Text-Only RHOAR

Fixes 7 records

TI-2019-09232 CVE-2019-12384 · GHSA-mph4-vhrx-mv67

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of…

MEDIUM 62

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.45205 Published 2019-06-24 Partial fix · 2.9.9.1, 2.8.11.4 +2 CWE-502

TI-2019-10718 CVE-2019-14379 · GHSA-6fpp-rgj9-8rwc

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default…

MEDIUM 60

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code ex…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08111 Published 2019-07-29 Partial fix · 2.9.9.2, 2.8.11.4 +1 CWE-1321

TI-2019-09017 CVE-2019-12086 · GHSA-5ww9-j83m-q7qx

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.

MEDIUM 58

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.21949 Published 2019-05-17 Partial fix · 2.9.9, 2.8.11.4 +2 CWE-502

TI-2019-02898 CVE-2019-3888 · GHSA-jwgx-9mmh-684w

Sensitive information in log files in Red Hat undertow

MEDIUM 48

A vulnerability was found in Undertow web server before 2.0.21.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03028 Published 2019-06-12 Partial fix · 2.0.21 CWE-532

TI-2019-07532 CVE-2019-10212 · GHSA-8vh8-vc28-m2hf

Sensitive information in log files in Red Hat undertow

MEDIUM 46

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01892 Published 2019-10-02 Partial fix · 2.0.20 CWE-532

TI-2019-07505 CVE-2019-10184 · GHSA-w69w-jvc7-wjgv

Missing authorization in undertow-io undertow

LOW 39

undertow before version 2.0.23.Final is vulnerable to an information leak issue.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03478 Published 2019-07-25 Partial fix · 2.0.23 CWE-862

TI-2019-02878 CVE-2019-3868 · GHSA-gc52-xj6p-9pxp

Information disclosure in Red Hat keycloak

LOW 20

Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC.

CVSS 3.0LOW 3.8 Network High privileges No interaction EPSS 0.01005 Published 2019-04-24 Partial fix · 6.0.0 CWE-200