Read the docs
TI-2019-05979 Aliases CVE-2019-8331GHSA-9v3m-8fp8-mj99

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Priority MEDIUM 44CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Partial Red Hat: 19 fixed, 13 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-79.

Summary

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Why it matters now

EPSS 0.16404 96th percentileScored 2026-11-07
Fix Partial bootstrap (RubyGems): 4.3.1bootstrap-sass (RubyGems): 3.4.1+8 more productsRed Hat: 15 advisoriesRed Hat: 19 fixed, 13 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—bootstrap (RubyGems)before 4.3.14.3.1Patch availableGHSA-9v3m-8fp8-mj99
—bootstrap-sass (RubyGems)3.0.0 to before 3.4.13.4.1Patch availableGHSA-9v3m-8fp8-mj99
—Bootstrap.Less (NuGet)3.0.0 to before 3.4.13.4.1Patch availableGHSA-9v3m-8fp8-mj99
—bootstrap (NuGet)4.0.0 to before 4.3.14.3.1Patch availableGHSA-9v3m-8fp8-mj99
—bootstrap (NuGet)3.0.0 to before 3.4.13.4.1Patch availableGHSA-9v3m-8fp8-mj99
—bootstrap.sass (NuGet)before 4.3.14.3.1Patch availableGHSA-9v3m-8fp8-mj99
—bootstrap (npm)4.0.0 to before 4.3.14.3.1Patch availableGHSA-9v3m-8fp8-mj99
—bootstrap (npm)3.0.0 to before 3.4.13.4.1Patch availableGHSA-9v3m-8fp8-mj99
—bootstrap-sass (npm)3.0.0 to before 3.4.13.4.1Patch availableGHSA-9v3m-8fp8-mj99
—twitter-bootstrap-rails (RubyGems)before 5.3.05.3.0Patch availableGHSA-9v3m-8fp8-mj99
—org.webjars:bootstrap (Maven)3.0.0 to before 3.4.13.4.1Patch availableGHSA-9v3m-8fp8-mj99
—org.webjars:bootstrap (Maven)4.0.0 to before 4.3.14.3.1Patch availableGHSA-9v3m-8fp8-mj99
—twbs/bootstrap (Packagist)3.0.0 to before 3.4.13.4.1Patch availableGHSA-9v3m-8fp8-mj99
—twbs/bootstrap (Packagist)4.0.0 to before 4.3.14.3.1Patch availableGHSA-9v3m-8fp8-mj99
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • bootstrap (RubyGems) Vendor— Affected before 4.3.1 Fixed in 4.3.1 Patch available GHSA-9v3m-8fp8-mj99
  • bootstrap-sass (RubyGems) Vendor— Affected 3.0.0 to before 3.4.1 Fixed in 3.4.1 Patch available GHSA-9v3m-8fp8-mj99
  • Bootstrap.Less (NuGet) Vendor— Affected 3.0.0 to before 3.4.1 Fixed in 3.4.1 Patch available GHSA-9v3m-8fp8-mj99
  • bootstrap (NuGet) Vendor— Affected 4.0.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-9v3m-8fp8-mj99
  • bootstrap (NuGet) Vendor— Affected 3.0.0 to before 3.4.1 Fixed in 3.4.1 Patch available GHSA-9v3m-8fp8-mj99
  • bootstrap.sass (NuGet) Vendor— Affected before 4.3.1 Fixed in 4.3.1 Patch available GHSA-9v3m-8fp8-mj99
  • bootstrap (npm) Vendor— Affected 4.0.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-9v3m-8fp8-mj99
  • bootstrap (npm) Vendor— Affected 3.0.0 to before 3.4.1 Fixed in 3.4.1 Patch available GHSA-9v3m-8fp8-mj99
  • bootstrap-sass (npm) Vendor— Affected 3.0.0 to before 3.4.1 Fixed in 3.4.1 Patch available GHSA-9v3m-8fp8-mj99
  • twitter-bootstrap-rails (RubyGems) Vendor— Affected before 5.3.0 Fixed in 5.3.0 Patch available GHSA-9v3m-8fp8-mj99
  • org.webjars:bootstrap (Maven) Vendor— Affected 3.0.0 to before 3.4.1 Fixed in 3.4.1 Patch available GHSA-9v3m-8fp8-mj99
  • org.webjars:bootstrap (Maven) Vendor— Affected 4.0.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-9v3m-8fp8-mj99
  • twbs/bootstrap (Packagist) Vendor— Affected 3.0.0 to before 3.4.1 Fixed in 3.4.1 Patch available GHSA-9v3m-8fp8-mj99
  • twbs/bootstrap (Packagist) Vendor— Affected 4.0.0 to before 4.3.1 Fixed in 4.3.1 Patch available GHSA-9v3m-8fp8-mj99

CPE configurations NVD · 16

CPEVersionsRoleVendor
cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*before 3.4.1; 4.3.0 to before 4.3.1VulnerableGetbootstrap
cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
  • cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:* Versions before 3.4.1; 4.3.0 to before 4.3.1 Vulnerable ·Getbootstrap
  • cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
Show 6 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0VulnerableF5
cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:*4.3VulnerableRed Hat
cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*before 5.19.0VulnerableTenable
  • cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:* Versions 12.1.0 to before 12.1.5.1; 13.0.0 to before 13.1.3.4; 14.0.0 to before 14.1.2.5; 15.0.0 to before 15.1.0 Vulnerable ·F5
  • cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:* Versions 4.3 Vulnerable ·Red Hat
  • cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:* Versions before 5.19.0 Vulnerable ·Tenable

Remediation

  • Fix · GHSA-9v3m-8fp8-mj99 bootstrap (RubyGems) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 bootstrap-sass (RubyGems) Fixed in 3.4.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 Bootstrap.Less (NuGet) Fixed in 3.4.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 bootstrap (NuGet) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 bootstrap (NuGet) Fixed in 3.4.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 bootstrap.sass (NuGet) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 bootstrap (npm) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 bootstrap (npm) Fixed in 3.4.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 bootstrap-sass (npm) Fixed in 3.4.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 twitter-bootstrap-rails (RubyGems) Fixed in 5.3.0 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 org.webjars:bootstrap (Maven) Fixed in 3.4.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 org.webjars:bootstrap (Maven) Fixed in 4.3.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 twbs/bootstrap (Packagist) Fixed in 3.4.1 Advisory →
  • Fix · GHSA-9v3m-8fp8-mj99 twbs/bootstrap (Packagist) Fixed in 4.3.1 Advisory →

Red Hat 15 advisories

  • RHSA-2023:0556 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss Enterprise Application Platform 7.4.9 com.fasterxml.jackson.core.jackson-databind-2.12.7.redhat-00003.jar, com.fasterxml.woodstox.woodstox-core-6.4.0.redhat-00001.jar, org.apache.cxf.cxf-core-3.4.10.redhat-00001.jar +4
  • RHSA-2023:0554 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el9eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el9eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el9eap +44
  • RHSA-2023:0552 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-apache-sshd-2.9.2-1.redhat_00001.1.el7eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el7eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el7eap +46
Show 12 more Red Hat advisories
  • RHSA-2023:0553 Released 2023-01-31 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.9 Security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-apache-sshd-2.9.2-1.redhat_00001.1.el8eap, eap7-elytron-web-1.9.3-1.Final_redhat_00001.1.el8eap, eap7-hal-console-3.3.16-1.Final_redhat_00001.1.el8eap +44
  • RHSA-2022:8865 Released 2022-12-07 · Red Hat rating Moderate
    Red Hat OpenStack 16.1.9 (python-XStatic-Bootstrap-SCSS) security update
    • Red Hat OpenStack Platform 16.1 python-XStatic-Bootstrap-SCSS-3.4.1.0-2.el8ost
  • RHSA-2022:8848 Released 2022-12-07 · Red Hat rating Moderate
    Red Hat OpenStack 16.2.4 (python-XStatic-Bootstrap-SCSS) security update
    • Red Hat OpenStack Platform 16.2 python-XStatic-Bootstrap-SCSS-3.4.1.0-2.el8ost, python3-XStatic-Bootstrap-SCSS-3.4.1.0-2.el8ost, xstatic-bootstrap-scss-common-3.4.1.0-2.el8ost
  • RHSA-2022:8652 Released 2022-11-28 · Red Hat rating Important
    Red Hat Fuse 7.11.1 release and security update
    • Red Hat Fuse 7.11.1
  • RHSA-2020:5571 Released 2020-12-16 · Red Hat rating Moderate
    python-XStatic-Bootstrap-SCSS security update
    • Red Hat OpenStack Platform 13.0 python-XStatic-Bootstrap-SCSS-3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common-3.4.1.0-1.el7ost
    • Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS Server python-XStatic-Bootstrap-SCSS-3.4.1.0-1.el7ost, xstatic-bootstrap-scss-common-3.4.1.0-1.el7ost
  • RHSA-2020:4847 Released 2020-11-04 · Red Hat rating Moderate
    pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6, apache-commons-collections-3.2.2-10.module+el8.1.0+3366+6dfb954c.src::pki-deps:10.6, apache-commons-lang-2.6-21.module+el8.1.0+3366+6dfb954c.noarch::pki-deps:10.6 +47
  • RHSA-2020:4670 Released 2020-11-04 · Red Hat rating Moderate
    idm:DL1 and idm:client security, bug fix, and enhancement update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.aarch64::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.ppc64le::idm:DL1, bind-dyndb-ldap-11.3-1.module+el8.3.0+6993+104f8db0.s390x::idm:DL1 +47
  • RHSA-2020:3936 Released 2020-09-29 · Red Hat rating Moderate
    ipa security, bug fix, and enhancement update
    • Red Hat Enterprise Linux Client (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
    • Red Hat Enterprise Linux Client Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
    • Red Hat Enterprise Linux ComputeNode (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +4
    • Red Hat Enterprise Linux ComputeNode Optional (v. 7) ipa-server-4.6.8-5.el7, ipa-server-common-4.6.8-5.el7, ipa-server-dns-4.6.8-5.el7 +2
    • Red Hat Enterprise Linux Server (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
    • Red Hat Enterprise Linux Workstation (v. 7) ipa-4.6.8-5.el7, ipa-client-4.6.8-5.el7, ipa-client-common-4.6.8-5.el7 +9
  • RHSA-2020:3247 Released 2020-08-04 · Red Hat rating Important
    RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update
    • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 novnc-1.1.0-1.el8ost, ovirt-engine-4.4.1.8-0.7.el8ev, ovirt-engine-api-explorer-0.0.6-1.el8ev +21
  • RHSA-2019:3024 Released 2019-10-10 · Red Hat rating Moderate
    ovirt-web-ui security and bug fix update
    • RHV-M 4.3 ovirt-web-ui-1.6.0-1.el7ev
  • RHSA-2019:3023 Released 2019-10-10 · Red Hat rating Moderate
    ovirt-engine-ui-extensions security and bug fix update
    • RHV-M 4.3 ovirt-engine-ui-extensions-1.0.10-1.el7ev
  • RHSA-2019:1456 Released 2019-06-11 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.3.2 security update
    • Red Hat Single Sign-On 7.3.2 zip

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Decision Manager 7AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Web Server 2AffectedNo fix planned: Out of support scope
Red Hat OpenShift Application RuntimesAffectedNo fix yet
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 14 (Rocky)AffectedNo fix yet
Red Hat OpenStack Platform 15 (Stein)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 8 (Liberty)AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 9 (Mitaka)AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Satellite 5AffectedNo fix planned: Out of support scope
Red Hat Virtualization 4AffectedNo fix planned: Out of support scope
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4Fixed RHSA-2020:3247
RHV-M 4.3Fixed RHSA-2019:3023, RHSA-2019:3024
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2020:4670, RHSA-2020:4847
Red Hat Enterprise Linux Client (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Client Optional (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux ComputeNode (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux ComputeNode Optional (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2020:3936
Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2020:3936
Red Hat Fuse 7.11.1Fixed RHSA-2022:8652
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:0552
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:0553
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:0554
Red Hat JBoss Enterprise Application Platform 7.4.9Fixed RHSA-2023:0556
Red Hat OpenStack Platform 13.0Fixed RHSA-2020:5571
Red Hat OpenStack Platform 13.0 for RHEL 7.6 EUS ServerFixed RHSA-2020:5571
Red Hat OpenStack Platform 16.1Fixed RHSA-2022:8865
Red Hat OpenStack Platform 16.2Fixed RHSA-2022:8848
Red Hat Single Sign-On 7.3.2 zipFixed RHSA-2019:1456
Not affected: 11 products
  • CloudForms Management Engine 5
  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • Red Hat 3scale API Management Platform 2
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss EAP 7.4 for RHEL 9
  • Red Hat JBoss Enterprise Application Platform 7.4.9
  • Red Hat OpenStack Platform 16.1
  • Red Hat OpenStack Platform 16.2
  • Red Hat Quay 3
  • Red Hat Satellite 6

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-8331
  2. 2026-10-03 Alias added: GHSA-9v3m-8fp8-mj99

References

Patch 2

Advisory 15

Other 29

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences