Read the docs
Red Hat Security Advisory

RHSA-2020:0895

Red Hat Process Automation Manager 7.7.0 Security Update

Released 2020-03-18 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 10 records

TI-2019-11096 CVE-2019-14892 · GHSA-cf6r-3wgc-h863

Information disclosure in Red Hat jackson-databind

Priority MEDIUM 57

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05576 Published 2020-03-02 Partial fix · 2.9.10, 2.8.11.5 +1 CWE-200
TI-2019-11097 CVE-2019-14893 · GHSA-qmqc-x3r4-6v39

Information disclosure in Red Hat jackson-databind

Priority MEDIUM 56

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction wi…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.04091 Published 2020-03-02 Partial fix · 2.9.10 CWE-200
TI-2019-05365 CVE-2019-7611 · GHSA-fj32-6v7m-57pg

Improper access control in Elasticsearch

Priority LOW 39

A permission issue was found in Elasticsearch versions before 5.6.15 and 6.6.1 when Field Level Security and Document Level Security are disabled and the _aliases, _shrink, or _split endpoints are used .

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.02149 Published 2019-03-25 Partial fix · 5.6.15, 6.6.1 CWE-284
TI-2019-00204 CVE-2019-0231 · GHSA-5h29-qq92-wj7f

Apache MINA SSLFilter security Issue

Priority LOW 37

Handling of the close_notify SSL/TLS message does not lead to a connection closure, leading the server to retain the socket opened and to have the client potentially receive clear text messages afterward.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02125 Published 2019-10-01 Partial fix · 2.0.21, 2.1.1 CWE-319