ALSA-2020:1644

Dashboard / Vulnerabilities / ALSA-2020:1644

ALSA-2020:1644

Summary: Moderate: pki-core:10.6 and pki-deps:10.6 security, bug fix, and enhancement update

Details: The Public Key Infrastructure (PKI) Core contains fundamental packages required by AlmaLinux Certificate System. Security Fix(es): * jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig (CVE-2019-14540) * jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource (CVE-2019-16335) * jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.* (CVE-2019-16942) * jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource (CVE-2019-16943) * jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.* (CVE-2019-17531) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

References: https://errata.almalinux.org/8/ALSA-2020-1644.html, https://vulners.com/cve/CVE-2019-14540, https://vulners.com/cve/CVE-2019-16335, https://vulners.com/cve/CVE-2019-16942, https://vulners.com/cve/CVE-2019-16943, https://vulners.com/cve/CVE-2019-17531, https://vulners.com/cve/CVE-2019-20330, https://vulners.com/cve/CVE-2020-10672, https://vulners.com/cve/CVE-2020-10673, https://vulners.com/cve/CVE-2020-8840, https://vulners.com/cve/CVE-2020-9546, https://vulners.com/cve/CVE-2020-9547, https://vulners.com/cve/CVE-2020-9548