-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   Red Hat Security Advisory

Synopsis:          Important: pki-deps:10.6 security update
Advisory ID:       RHSA-2019:1529-01
Product:           Red Hat Enterprise Linux
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:1529
Issue date:        2019-06-18
CVE Names:         CVE-2018-8014 CVE-2018-8034 CVE-2018-8037 
                   CVE-2018-11784 
====================================================================
1. Summary:

An update for the pki-deps:10.6 module is now available for Red Hat
Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64

3. Description:

The Public Key Infrastructure (PKI) Deps module contains fundamental
packages required as dependencies for the pki-core module by Red Hat
Certificate System.

Security Fix(es):

* tomcat: Due to a mishandling of close in NIO/NIO2 connectors user
sessions can get mixed up (CVE-2018-8037)

* tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for
all origins (CVE-2018-8014)

* tomcat: Open redirect in default servlet (CVE-2018-11784)

* tomcat: Host name verification missing in WebSocket client
(CVE-2018-8034)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1579611 - CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
1607580 - CVE-2018-8034 tomcat: Host name verification missing in WebSocket client
1607582 - CVE-2018-8037 tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up
1636512 - CVE-2018-11784 tomcat: Open redirect in default servlet

6. Package List:

Red Hat Enterprise Linux AppStream (v. 8):

Source:
apache-commons-collections-3.2.2-10.module+el8.0.0+3248+9d514f3b.src.rpm
apache-commons-lang-2.6-21.module+el8.0.0+3248+9d514f3b.src.rpm
bea-stax-1.2.0-16.module+el8.0.0+3248+9d514f3b.src.rpm
glassfish-fastinfoset-1.2.13-9.module+el8.0.0+3248+9d514f3b.src.rpm
glassfish-jaxb-2.2.11-11.module+el8.0.0+3248+9d514f3b.src.rpm
glassfish-jaxb-api-2.2.12-8.module+el8.0.0+3248+9d514f3b.src.rpm
jackson-annotations-2.9.8-1.module+el8.0.0+3248+9d514f3b.src.rpm
jackson-core-2.9.8-1.module+el8.0.0+3248+9d514f3b.src.rpm
jackson-databind-2.9.8-1.module+el8.0.0+3248+9d514f3b.src.rpm
jackson-jaxrs-providers-2.9.8-1.module+el8.0.0+3248+9d514f3b.src.rpm
jackson-module-jaxb-annotations-2.7.6-4.module+el8.0.0+3248+9d514f3b.src.rpm
jakarta-commons-httpclient-3.1-28.module+el8.0.0+3248+9d514f3b.src.rpm
javassist-3.18.1-8.module+el8.0.0+3248+9d514f3b.src.rpm
pki-servlet-container-9.0.7-14.module+el8.0.0+3248+9d514f3b.src.rpm
python-nss-1.0.1-10.module+el8.0.0+3248+9d514f3b.src.rpm
relaxngDatatype-2011.1-7.module+el8.0.0+3248+9d514f3b.src.rpm
resteasy-3.0.26-3.module+el8.0.0+3248+9d514f3b.src.rpm
slf4j-1.7.25-4.module+el8.0.0+3248+9d514f3b.src.rpm
stax-ex-1.7.7-8.module+el8.0.0+3248+9d514f3b.src.rpm
velocity-1.7-24.module+el8.0.0+3248+9d514f3b.src.rpm
xalan-j2-2.7.1-38.module+el8.0.0+3248+9d514f3b.src.rpm
xerces-j2-2.11.0-34.module+el8.0.0+3248+9d514f3b.src.rpm
xml-commons-apis-1.4.01-25.module+el8.0.0+3248+9d514f3b.src.rpm
xml-commons-resolver-1.2-26.module+el8.0.0+3248+9d514f3b.src.rpm
xmlstreambuffer-1.5.4-8.module+el8.0.0+3248+9d514f3b.src.rpm
xsom-0-19.20110809svn.module+el8.0.0+3248+9d514f3b.src.rpm

aarch64:
python-nss-debugsource-1.0.1-10.module+el8.0.0+3248+9d514f3b.aarch64.rpm
python-nss-doc-1.0.1-10.module+el8.0.0+3248+9d514f3b.aarch64.rpm
python3-nss-1.0.1-10.module+el8.0.0+3248+9d514f3b.aarch64.rpm
python3-nss-debuginfo-1.0.1-10.module+el8.0.0+3248+9d514f3b.aarch64.rpm

noarch:
apache-commons-collections-3.2.2-10.module+el8.0.0+3248+9d514f3b.noarch.rpm
apache-commons-lang-2.6-21.module+el8.0.0+3248+9d514f3b.noarch.rpm
bea-stax-api-1.2.0-16.module+el8.0.0+3248+9d514f3b.noarch.rpm
glassfish-fastinfoset-1.2.13-9.module+el8.0.0+3248+9d514f3b.noarch.rpm
glassfish-jaxb-api-2.2.12-8.module+el8.0.0+3248+9d514f3b.noarch.rpm
glassfish-jaxb-core-2.2.11-11.module+el8.0.0+3248+9d514f3b.noarch.rpm
glassfish-jaxb-runtime-2.2.11-11.module+el8.0.0+3248+9d514f3b.noarch.rpm
glassfish-jaxb-txw2-2.2.11-11.module+el8.0.0+3248+9d514f3b.noarch.rpm
jackson-annotations-2.9.8-1.module+el8.0.0+3248+9d514f3b.noarch.rpm
jackson-core-2.9.8-1.module+el8.0.0+3248+9d514f3b.noarch.rpm
jackson-databind-2.9.8-1.module+el8.0.0+3248+9d514f3b.noarch.rpm
jackson-jaxrs-json-provider-2.9.8-1.module+el8.0.0+3248+9d514f3b.noarch.rpm
jackson-jaxrs-providers-2.9.8-1.module+el8.0.0+3248+9d514f3b.noarch.rpm
jackson-module-jaxb-annotations-2.7.6-4.module+el8.0.0+3248+9d514f3b.noarch.rpm
jakarta-commons-httpclient-3.1-28.module+el8.0.0+3248+9d514f3b.noarch.rpm
javassist-3.18.1-8.module+el8.0.0+3248+9d514f3b.noarch.rpm
javassist-javadoc-3.18.1-8.module+el8.0.0+3248+9d514f3b.noarch.rpm
pki-servlet-4.0-api-9.0.7-14.module+el8.0.0+3248+9d514f3b.noarch.rpm
pki-servlet-container-9.0.7-14.module+el8.0.0+3248+9d514f3b.noarch.rpm
relaxngDatatype-2011.1-7.module+el8.0.0+3248+9d514f3b.noarch.rpm
resteasy-3.0.26-3.module+el8.0.0+3248+9d514f3b.noarch.rpm
slf4j-1.7.25-4.module+el8.0.0+3248+9d514f3b.noarch.rpm
slf4j-jdk14-1.7.25-4.module+el8.0.0+3248+9d514f3b.noarch.rpm
stax-ex-1.7.7-8.module+el8.0.0+3248+9d514f3b.noarch.rpm
velocity-1.7-24.module+el8.0.0+3248+9d514f3b.noarch.rpm
xalan-j2-2.7.1-38.module+el8.0.0+3248+9d514f3b.noarch.rpm
xerces-j2-2.11.0-34.module+el8.0.0+3248+9d514f3b.noarch.rpm
xml-commons-apis-1.4.01-25.module+el8.0.0+3248+9d514f3b.noarch.rpm
xml-commons-resolver-1.2-26.module+el8.0.0+3248+9d514f3b.noarch.rpm
xmlstreambuffer-1.5.4-8.module+el8.0.0+3248+9d514f3b.noarch.rpm
xsom-0-19.20110809svn.module+el8.0.0+3248+9d514f3b.noarch.rpm

ppc64le:
python-nss-debugsource-1.0.1-10.module+el8.0.0+3248+9d514f3b.ppc64le.rpm
python-nss-doc-1.0.1-10.module+el8.0.0+3248+9d514f3b.ppc64le.rpm
python3-nss-1.0.1-10.module+el8.0.0+3248+9d514f3b.ppc64le.rpm
python3-nss-debuginfo-1.0.1-10.module+el8.0.0+3248+9d514f3b.ppc64le.rpm

s390x:
python-nss-debugsource-1.0.1-10.module+el8.0.0+3248+9d514f3b.s390x.rpm
python-nss-doc-1.0.1-10.module+el8.0.0+3248+9d514f3b.s390x.rpm
python3-nss-1.0.1-10.module+el8.0.0+3248+9d514f3b.s390x.rpm
python3-nss-debuginfo-1.0.1-10.module+el8.0.0+3248+9d514f3b.s390x.rpm

x86_64:
python-nss-debugsource-1.0.1-10.module+el8.0.0+3248+9d514f3b.x86_64.rpm
python-nss-doc-1.0.1-10.module+el8.0.0+3248+9d514f3b.x86_64.rpm
python3-nss-1.0.1-10.module+el8.0.0+3248+9d514f3b.x86_64.rpm
python3-nss-debuginfo-1.0.1-10.module+el8.0.0+3248+9d514f3b.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-8014
https://access.redhat.com/security/cve/CVE-2018-8034
https://access.redhat.com/security/cve/CVE-2018-8037
https://access.redhat.com/security/cve/CVE-2018-11784
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXQkeDtzjgjWX9erEAQh4cQ//fg5lnn+3Xer6shipZjmeMhzjx9eZb2ND
8A0qDT3i4N4Hmir9YclQyTUi8peNF2e5MwjKqtyeppzsktnetwHYrMRFhU1iF18U
Ghry0Dt44t1y5yDkwsNX25BECgWf4AkIcLtW1u2jOOnH7lTnEOe6Za3NCqoJ8PXY
pVV41/NLLLoFNzR1DqqKsGXNemimjZBUgJlSQG13oTGruBy5TBBBwDBEodf87+hx
qdOipbF+4wRv7IzlCohCqmaVGXyb2ksZakIfV95db63n8Xm1SyK3wiu33bzUHdeH
AH23hUsqpHXjflRWpksq5gg1vAA3T6h0UjpsLHKr++RrVCLrdzst/lR3gTvjdYvL
eWwj452PYOrLE85QOhpIS77otE0HHaJxkgh8167P6TVGqEohFVulc9OXlspUpcGx
873bqr6y98T/Yw0EeMK3jNt8RUgl3adJzhwBkIvv33zatPRnvPE6CHDI2qNFVMMr
oppwpP8gbikZepYrJwtdAhrDI7irwFCYNIG4mbXVmUMFyRz8e3YkGMZ4v8SKavI0
L3ZCUcAiPBkXZJmPt9MgsQGiZE21DIOoYytlvwDlGSACx9iGxY1muB1i8W3umg7Y
SGM6vz14/J/kg8LoHoNFvKhKAE0WFf8fBJjKCG4zD28uqLxNiN5mAdElbGvQpzOs
DEC6B3LZjok=6kQ3
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

RedHat: RHSA-2019-1529:01 Important: pki-deps:10.6 security update

An update for the pki-deps:10.6 module is now available for Red Hat Enterprise Linux 8

Summary

The Public Key Infrastructure (PKI) Deps module contains fundamental packages required as dependencies for the pki-core module by Red Hat Certificate System.
Security Fix(es):
* tomcat: Due to a mishandling of close in NIO/NIO2 connectors user sessions can get mixed up (CVE-2018-8037)
* tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)
* tomcat: Open redirect in default servlet (CVE-2018-11784)
* tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Summary

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

References

https://access.redhat.com/security/cve/CVE-2018-8014 https://access.redhat.com/security/cve/CVE-2018-8034 https://access.redhat.com/security/cve/CVE-2018-8037 https://access.redhat.com/security/cve/CVE-2018-11784 https://access.redhat.com/security/updates/classification/#important

Package List

Red Hat Enterprise Linux AppStream (v. 8):
Source: apache-commons-collections-3.2.2-10.module+el8.0.0+3248+9d514f3b.src.rpm apache-commons-lang-2.6-21.module+el8.0.0+3248+9d514f3b.src.rpm bea-stax-1.2.0-16.module+el8.0.0+3248+9d514f3b.src.rpm glassfish-fastinfoset-1.2.13-9.module+el8.0.0+3248+9d514f3b.src.rpm glassfish-jaxb-2.2.11-11.module+el8.0.0+3248+9d514f3b.src.rpm glassfish-jaxb-api-2.2.12-8.module+el8.0.0+3248+9d514f3b.src.rpm jackson-annotations-2.9.8-1.module+el8.0.0+3248+9d514f3b.src.rpm jackson-core-2.9.8-1.module+el8.0.0+3248+9d514f3b.src.rpm jackson-databind-2.9.8-1.module+el8.0.0+3248+9d514f3b.src.rpm jackson-jaxrs-providers-2.9.8-1.module+el8.0.0+3248+9d514f3b.src.rpm jackson-module-jaxb-annotations-2.7.6-4.module+el8.0.0+3248+9d514f3b.src.rpm jakarta-commons-httpclient-3.1-28.module+el8.0.0+3248+9d514f3b.src.rpm javassist-3.18.1-8.module+el8.0.0+3248+9d514f3b.src.rpm pki-servlet-container-9.0.7-14.module+el8.0.0+3248+9d514f3b.src.rpm python-nss-1.0.1-10.module+el8.0.0+3248+9d514f3b.src.rpm relaxngDatatype-2011.1-7.module+el8.0.0+3248+9d514f3b.src.rpm resteasy-3.0.26-3.module+el8.0.0+3248+9d514f3b.src.rpm slf4j-1.7.25-4.module+el8.0.0+3248+9d514f3b.src.rpm stax-ex-1.7.7-8.module+el8.0.0+3248+9d514f3b.src.rpm velocity-1.7-24.module+el8.0.0+3248+9d514f3b.src.rpm xalan-j2-2.7.1-38.module+el8.0.0+3248+9d514f3b.src.rpm xerces-j2-2.11.0-34.module+el8.0.0+3248+9d514f3b.src.rpm xml-commons-apis-1.4.01-25.module+el8.0.0+3248+9d514f3b.src.rpm xml-commons-resolver-1.2-26.module+el8.0.0+3248+9d514f3b.src.rpm xmlstreambuffer-1.5.4-8.module+el8.0.0+3248+9d514f3b.src.rpm xsom-0-19.20110809svn.module+el8.0.0+3248+9d514f3b.src.rpm
aarch64: python-nss-debugsource-1.0.1-10.module+el8.0.0+3248+9d514f3b.aarch64.rpm python-nss-doc-1.0.1-10.module+el8.0.0+3248+9d514f3b.aarch64.rpm python3-nss-1.0.1-10.module+el8.0.0+3248+9d514f3b.aarch64.rpm python3-nss-debuginfo-1.0.1-10.module+el8.0.0+3248+9d514f3b.aarch64.rpm
noarch: apache-commons-collections-3.2.2-10.module+el8.0.0+3248+9d514f3b.noarch.rpm apache-commons-lang-2.6-21.module+el8.0.0+3248+9d514f3b.noarch.rpm bea-stax-api-1.2.0-16.module+el8.0.0+3248+9d514f3b.noarch.rpm glassfish-fastinfoset-1.2.13-9.module+el8.0.0+3248+9d514f3b.noarch.rpm glassfish-jaxb-api-2.2.12-8.module+el8.0.0+3248+9d514f3b.noarch.rpm glassfish-jaxb-core-2.2.11-11.module+el8.0.0+3248+9d514f3b.noarch.rpm glassfish-jaxb-runtime-2.2.11-11.module+el8.0.0+3248+9d514f3b.noarch.rpm glassfish-jaxb-txw2-2.2.11-11.module+el8.0.0+3248+9d514f3b.noarch.rpm jackson-annotations-2.9.8-1.module+el8.0.0+3248+9d514f3b.noarch.rpm jackson-core-2.9.8-1.module+el8.0.0+3248+9d514f3b.noarch.rpm jackson-databind-2.9.8-1.module+el8.0.0+3248+9d514f3b.noarch.rpm jackson-jaxrs-json-provider-2.9.8-1.module+el8.0.0+3248+9d514f3b.noarch.rpm jackson-jaxrs-providers-2.9.8-1.module+el8.0.0+3248+9d514f3b.noarch.rpm jackson-module-jaxb-annotations-2.7.6-4.module+el8.0.0+3248+9d514f3b.noarch.rpm jakarta-commons-httpclient-3.1-28.module+el8.0.0+3248+9d514f3b.noarch.rpm javassist-3.18.1-8.module+el8.0.0+3248+9d514f3b.noarch.rpm javassist-javadoc-3.18.1-8.module+el8.0.0+3248+9d514f3b.noarch.rpm pki-servlet-4.0-api-9.0.7-14.module+el8.0.0+3248+9d514f3b.noarch.rpm pki-servlet-container-9.0.7-14.module+el8.0.0+3248+9d514f3b.noarch.rpm relaxngDatatype-2011.1-7.module+el8.0.0+3248+9d514f3b.noarch.rpm resteasy-3.0.26-3.module+el8.0.0+3248+9d514f3b.noarch.rpm slf4j-1.7.25-4.module+el8.0.0+3248+9d514f3b.noarch.rpm slf4j-jdk14-1.7.25-4.module+el8.0.0+3248+9d514f3b.noarch.rpm stax-ex-1.7.7-8.module+el8.0.0+3248+9d514f3b.noarch.rpm velocity-1.7-24.module+el8.0.0+3248+9d514f3b.noarch.rpm xalan-j2-2.7.1-38.module+el8.0.0+3248+9d514f3b.noarch.rpm xerces-j2-2.11.0-34.module+el8.0.0+3248+9d514f3b.noarch.rpm xml-commons-apis-1.4.01-25.module+el8.0.0+3248+9d514f3b.noarch.rpm xml-commons-resolver-1.2-26.module+el8.0.0+3248+9d514f3b.noarch.rpm xmlstreambuffer-1.5.4-8.module+el8.0.0+3248+9d514f3b.noarch.rpm xsom-0-19.20110809svn.module+el8.0.0+3248+9d514f3b.noarch.rpm
ppc64le: python-nss-debugsource-1.0.1-10.module+el8.0.0+3248+9d514f3b.ppc64le.rpm python-nss-doc-1.0.1-10.module+el8.0.0+3248+9d514f3b.ppc64le.rpm python3-nss-1.0.1-10.module+el8.0.0+3248+9d514f3b.ppc64le.rpm python3-nss-debuginfo-1.0.1-10.module+el8.0.0+3248+9d514f3b.ppc64le.rpm
s390x: python-nss-debugsource-1.0.1-10.module+el8.0.0+3248+9d514f3b.s390x.rpm python-nss-doc-1.0.1-10.module+el8.0.0+3248+9d514f3b.s390x.rpm python3-nss-1.0.1-10.module+el8.0.0+3248+9d514f3b.s390x.rpm python3-nss-debuginfo-1.0.1-10.module+el8.0.0+3248+9d514f3b.s390x.rpm
x86_64: python-nss-debugsource-1.0.1-10.module+el8.0.0+3248+9d514f3b.x86_64.rpm python-nss-doc-1.0.1-10.module+el8.0.0+3248+9d514f3b.x86_64.rpm python3-nss-1.0.1-10.module+el8.0.0+3248+9d514f3b.x86_64.rpm python3-nss-debuginfo-1.0.1-10.module+el8.0.0+3248+9d514f3b.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity

Advisory ID: RHSA-2019:1529-01

Product: Red Hat Enterprise Linux

Advisory URL: https://access.redhat.com/errata/RHSA-2019:1529

Issued Date: : 2019-06-18

CVE Names: CVE-2018-8014 CVE-2018-8034 CVE-2018-8037 CVE-2018-11784

Topic

An update for the pki-deps:10.6 module is now available for Red HatEnterprise Linux 8.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.