var-201907-1547
Vulnerability from variot

undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api. RedHatUndertow is a Java-based embedded Web server from RedHat, Inc., and is the default web server for Wildfly (Java Application Server). The vulnerability stems from errors in the configuration of the network system or product during operation. An unauthorized attacker can exploit the vulnerability to obtain sensitive information about the affected component.

The References section of this erratum contains a download link (you must log in to download the update).

The JBoss server process must be restarted for the update to take effect. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256

===================================================================== Red Hat Security Advisory

Synopsis: Important: Red Hat Single Sign-On 7.3.4 security update on RHEL 7 Advisory ID: RHSA-2019:3045-01 Product: Red Hat Single Sign-On Advisory URL: https://access.redhat.com/errata/RHSA-2019:3045 Issue date: 2019-10-14 CVE Names: CVE-2019-10184 CVE-2019-12086 CVE-2019-12814 CVE-2019-14379 CVE-2019-14820 CVE-2019-14832 =====================================================================

  1. Summary:

New Red Hat Single Sign-On 7.3.4 packages are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

  1. Relevant releases/architectures:

Red Hat Single Sign-On 7.3 for RHEL 7 Server - noarch, x86_64

  1. Description:

Red Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak project, that provides authentication and standards-based single sign-on capabilities for web and mobile applications.

This release of Red Hat Single Sign-On 7.3.4 on RHEL 7 serves as a replacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es):

  • keycloak: cross-realm user access auth bypass (CVE-2019-14832)

  • keycloak: adapter endpoints are exposed via arbitrary URLs (CVE-2019-14820)

  • jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message (CVE-2019-12814)

  • jackson-databind: default typing mishandling leading to remote code execution (CVE-2019-14379)

  • jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server (CVE-2019-12086)

  • undertow: Information leak in requests for directories without trailing slashes (CVE-2019-10184)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

  1. Solution:

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

  1. Bugs fixed (https://bugzilla.redhat.com/):

1649870 - CVE-2019-14820 keycloak: adapter endpoints are exposed via arbitrary URLs 1713068 - CVE-2019-10184 undertow: Information leak in requests for directories without trailing slashes 1713468 - CVE-2019-12086 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. 1725795 - CVE-2019-12814 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. 1737517 - CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution 1749487 - CVE-2019-14832 keycloak: cross-realm user access auth bypass

  1. JIRA issues fixed (https://issues.jboss.org/):

KEYCLOAK-11455 - Tracker bug for the RH-SSO 7.3.4 release for RHEL7

  1. Package List:

Red Hat Single Sign-On 7.3 for RHEL 7 Server:

Source: rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el7sso.src.rpm rh-sso7-libunix-dbus-java-0.8.0-2.el7sso.src.rpm

noarch: rh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el7sso.noarch.rpm rh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el7sso.noarch.rpm

x86_64: rh-sso7-libunix-dbus-java-0.8.0-2.el7sso.x86_64.rpm rh-sso7-libunix-dbus-java-debuginfo-0.8.0-2.el7sso.x86_64.rpm rh-sso7-libunix-dbus-java-devel-0.8.0-2.el7sso.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

  1. References:

https://access.redhat.com/security/cve/CVE-2019-10184 https://access.redhat.com/security/cve/CVE-2019-12086 https://access.redhat.com/security/cve/CVE-2019-12814 https://access.redhat.com/security/cve/CVE-2019-14379 https://access.redhat.com/security/cve/CVE-2019-14820 https://access.redhat.com/security/cve/CVE-2019-14832 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/

  1. Contact:

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1

iQIVAwUBXaS+uNzjgjWX9erEAQjtDg//d/4/1zudIgOeuPCs/B8ZCuh7ec/AKLRi dtHZHHLi9Sya+OpHxR57uoLmNAE7KROOuM/belMp+D8joZfzPED/yCVs7g052BXK HZ6faa/5TFD0rFY0Bv3gddYsjnjDLRGMW6j3BhpTnln8gShj+sGCVI1AESYykFJR PZf82VqYcUWZyKheCPFo3ckHys14jQkOYAldBMqjNNpmhL16O/gT4Urw2OBHwgMa iSFVRuIvRYZi0XQcHJAtAh+rHG2mbfY2S6qQhIESVPFOd5z8Rj2g/K4PQmCra4Uq 0vY4zPno78XMrbArJnH4dkfKObW8+EJ1295X33uJAStf/xX9UINeOzvq4i3CLOY4 aw67sqC1YPpQMpfRz1mlPdEmayv/hIBnycKqo0ehgxgwOq59QZrlqvWtxZrat0tS sf2th+hcOceglD9yLi7Zz/hLrFRjLS+c1KvI6Ho824Atu2Kfc7NdayT9JRJC7LUa 16NcMJj804E3vPVf1/YMAL852pOdfNgyFHBB3GTDbog0lVwbBxBiu6sgI8SKtYBA znUp1YAQiT4uWBu9cVSmLDPLWT+eLtnuYnRNgOyKYA6nEoqG2G4UKOQHDpaQ9Tn9 vzJvODlDvf/jQ4LnWscVGXy9EYoXcrFgSGaTb+y3zE8/rlOBUHTKW67FuVag3P7p RF7KTszoe+Y= =nzBy -----END PGP SIGNATURE-----

-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce . JIRA issues fixed (https://issues.jboss.org/):

JBEAP-16455 - GSS Upgrade Infinispan from 9.3.6 to 9.3.7 JBEAP-16779 - GSS Upgrade Hibernate ORM from 5.3.10 to 5.3.11 JBEAP-17045 - GSS Upgrade JSF based on Mojarra 2.3.5.SP3-redhat-00001 to 2.3.5.SP3-redhat-00002 JBEAP-17062 - GSS Upgrade Artemis from 2.7.0.redhat-00057 to 2.9.0.redhat-00005 JBEAP-17073 - GSS Upgrade jboss-ejb-client from 4.0.20 to 4.0.23 JBEAP-17109 - (7.2.z) Upgrade XNIO from 3.6.6.Final-redhat-00001 to 3.7.3.Final-redhat-00001 JBEAP-17112 - GSS Upgrade JBoss Remoting from 5.0.12 to 5.0.14.SP1 JBEAP-17144 - Tracker bug for the EAP 7.2.4 release for RHEL-8 JBEAP-17162 - GSS Upgrade jgroups from 4.0.19 to 4.0.20 JBEAP-17178 - (7.2.z) Upgrade IronJacamar from 1.4.16.Final to 1.4.17.Final JBEAP-17182 - (7.2.z) Upgrade PicketLink from 2.5.5.SP12-redhat-00006 to 2.5.5.SP12-redhat-00007 JBEAP-17183 - (7.2.z) Upgrade PicketLink bindings from 2.5.5.SP12-redhat-00006 to 2.5.5.SP12-redhat-00007 JBEAP-17223 - GSS Upgrade WildFly Core from 6.0.15 to 6.0.16 JBEAP-17238 - GSS Upgrade HAL from 3.0.13 to 3.0.16 JBEAP-17250 - GSS Upgrade JBoss MSC from 1.4.5 to 1.4.8 JBEAP-17271 - GSS Upgrade jboss-logmanager from 2.1.7.Final-redhat-00001 to 2.1.14.Final-redhat-00001 JBEAP-17273 - GSS Upgrade jboss-logging from 3.3.2.Final-redhat-00001 to 3.3.3.Final-redhat-00001 JBEAP-17274 - GSS Upgrade Wildfly Elytron from 1.6.3.Final-redhat-00001 to 1.6.4.Final-redhat-00001 JBEAP-17276 - GSS Upgrade wildfly-transaction-client from 1.1.4.Final-redhat-00001 to 1.1.6.Final-redhat-00001 JBEAP-17277 - GSS Upgrade Undertow from 2.0.22 to 2.0.25.SP1 JBEAP-17278 - GSS Upgrade JBoss Marshalling from 2.0.7 to 2.0.9 JBEAP-17294 - GSS Upgrade weld from 3.0.6.Final-redhat-00001 to 3.0.6.Final-redhat-00002 JBEAP-17311 - GSS Upgrade jboss-jaxrs-api_2.1_spec from 1.0.1.Final-redhat-00001 to 1.0.3.Final-redhat-00001 JBEAP-17320 - GSS Upgrade PicketBox from 5.0.3.Final-redhat-3 to 5.0.3.Final-redhat-00004 JBEAP-17321 - GSS Upgrade Narayana from 5.9.3.Final to 5.9.6.Final JBEAP-17334 - (7.2.z) Upgrade Elytron-Tool from 1.4.2 to 1.4.3.Final JBEAP-17527 - GSS Upgrade Hibernate ORM from 5.3.11 to 5.3.11.SP1

7

Show details on source website

To clipboard 

{
   "@context": {
      "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
      affected_products: {
         "@id": "https://www.variotdbs.pl/ref/affected_products",
      },
      configurations: {
         "@id": "https://www.variotdbs.pl/ref/configurations",
      },
      credits: {
         "@id": "https://www.variotdbs.pl/ref/credits",
      },
      cvss: {
         "@id": "https://www.variotdbs.pl/ref/cvss/",
      },
      description: {
         "@id": "https://www.variotdbs.pl/ref/description/",
      },
      exploit_availability: {
         "@id": "https://www.variotdbs.pl/ref/exploit_availability/",
      },
      external_ids: {
         "@id": "https://www.variotdbs.pl/ref/external_ids/",
      },
      iot: {
         "@id": "https://www.variotdbs.pl/ref/iot/",
      },
      iot_taxonomy: {
         "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/",
      },
      patch: {
         "@id": "https://www.variotdbs.pl/ref/patch/",
      },
      problemtype_data: {
         "@id": "https://www.variotdbs.pl/ref/problemtype_data/",
      },
      references: {
         "@id": "https://www.variotdbs.pl/ref/references/",
      },
      sources: {
         "@id": "https://www.variotdbs.pl/ref/sources/",
      },
      sources_release_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_release_date/",
      },
      sources_update_date: {
         "@id": "https://www.variotdbs.pl/ref/sources_update_date/",
      },
      threat_type: {
         "@id": "https://www.variotdbs.pl/ref/threat_type/",
      },
      title: {
         "@id": "https://www.variotdbs.pl/ref/title/",
      },
      type: {
         "@id": "https://www.variotdbs.pl/ref/type/",
      },
   },
   "@id": "https://www.variotdbs.pl/vuln/VAR-201907-1547",
   affected_products: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/affected_products#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            model: "jboss enterprise application platform",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: "7.3",
         },
         {
            model: "jboss enterprise application platform",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: null,
         },
         {
            model: "single sign-on",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: "7.0",
         },
         {
            model: "jboss enterprise application platform",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: "7.4",
         },
         {
            model: "single sign-on",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: "7.3",
         },
         {
            model: "single sign-on",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: null,
         },
         {
            model: "jboss enterprise application platform",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: "7.2",
         },
         {
            model: "active iq unified manager",
            scope: "eq",
            trust: 1,
            vendor: "netapp",
            version: null,
         },
         {
            model: "jboss enterprise application platform",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: "7.0.0",
         },
         {
            model: "openshift application runtimes",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: "1.0",
         },
         {
            model: "undertow",
            scope: "lt",
            trust: 1,
            vendor: "redhat",
            version: "2.0.23",
         },
         {
            model: "openshift application runtimes",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: null,
         },
         {
            model: "jboss data grid",
            scope: "eq",
            trust: 1,
            vendor: "redhat",
            version: null,
         },
         {
            model: "jboss enterprise application platform",
            scope: null,
            trust: 0.8,
            vendor: "red hat",
            version: null,
         },
         {
            model: "openshift application runtimes",
            scope: null,
            trust: 0.8,
            vendor: "red hat",
            version: null,
         },
         {
            model: "single sign-on",
            scope: null,
            trust: 0.8,
            vendor: "red hat",
            version: null,
         },
         {
            model: "undertow",
            scope: "lt",
            trust: 0.8,
            vendor: "red hat",
            version: "2.0.23",
         },
         {
            model: "hat red hat undertow <2.0.23.final",
            scope: null,
            trust: 0.6,
            vendor: "red",
            version: null,
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
         {
            db: "NVD",
            id: "CVE-2019-10184",
         },
      ],
   },
   configurations: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/configurations#",
         children: {
            "@container": "@list",
         },
         cpe_match: {
            "@container": "@list",
         },
         data: {
            "@container": "@list",
         },
         nodes: {
            "@container": "@list",
         },
      },
      data: [
         {
            CVE_data_version: "4.0",
            nodes: [
               {
                  cpe_match: [
                     {
                        cpe22Uri: "cpe:/a:redhat:jboss_enterprise_application_platform",
                        vulnerable: true,
                     },
                     {
                        cpe22Uri: "cpe:/a:redhat:openshift_application_runtimes",
                        vulnerable: true,
                     },
                     {
                        cpe22Uri: "cpe:/a:redhat:single_sign_on",
                        vulnerable: true,
                     },
                     {
                        cpe22Uri: "cpe:/a:redhat:undertow",
                        vulnerable: true,
                     },
                  ],
                  operator: "OR",
               },
            ],
         },
      ],
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
      ],
   },
   credits: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/credits#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "Red Hat",
      sources: [
         {
            db: "PACKETSTORM",
            id: "154845",
         },
         {
            db: "PACKETSTORM",
            id: "154686",
         },
         {
            db: "PACKETSTORM",
            id: "154687",
         },
         {
            db: "PACKETSTORM",
            id: "154850",
         },
         {
            db: "PACKETSTORM",
            id: "154844",
         },
         {
            db: "PACKETSTORM",
            id: "154793",
         },
         {
            db: "PACKETSTORM",
            id: "154665",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201907-1345",
         },
      ],
      trust: 1.3,
   },
   cve: "CVE-2019-10184",
   cvss: {
      "@context": {
         cvssV2: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2",
         },
         cvssV3: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/",
         },
         severity: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/cvss/severity#",
            },
            "@id": "https://www.variotdbs.pl/ref/cvss/severity",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
            "@id": "https://www.variotdbs.pl/ref/sources",
         },
      },
      data: [
         {
            cvssV2: [
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "nvd@nist.gov",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "CVE-2019-10184",
                  impactScore: 2.9,
                  integrityImpact: "NONE",
                  severity: "MEDIUM",
                  trust: 1.8,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
               {
                  accessComplexity: "LOW",
                  accessVector: "NETWORK",
                  authentication: "NONE",
                  author: "CNVD",
                  availabilityImpact: "NONE",
                  baseScore: 5,
                  confidentialityImpact: "PARTIAL",
                  exploitabilityScore: 10,
                  id: "CNVD-2019-24570",
                  impactScore: 2.9,
                  integrityImpact: "NONE",
                  severity: "MEDIUM",
                  trust: 0.6,
                  vectorString: "AV:N/AC:L/Au:N/C:P/I:N/A:N",
                  version: "2.0",
               },
            ],
            cvssV3: [
               {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  author: "nvd@nist.gov",
                  availabilityImpact: "NONE",
                  baseScore: 7.5,
                  baseSeverity: "HIGH",
                  confidentialityImpact: "HIGH",
                  exploitabilityScore: 3.9,
                  id: "CVE-2019-10184",
                  impactScore: 3.6,
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  trust: 1,
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.1",
               },
               {
                  attackComplexity: "LOW",
                  attackVector: "NETWORK",
                  author: "secalert@redhat.com",
                  availabilityImpact: "NONE",
                  baseScore: 5.3,
                  baseSeverity: "MEDIUM",
                  confidentialityImpact: "LOW",
                  exploitabilityScore: 3.9,
                  id: "CVE-2019-10184",
                  impactScore: 1.4,
                  integrityImpact: "NONE",
                  privilegesRequired: "NONE",
                  scope: "UNCHANGED",
                  trust: 1,
                  userInteraction: "NONE",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
                  version: "3.0",
               },
               {
                  attackComplexity: "Low",
                  attackVector: "Network",
                  author: "NVD",
                  availabilityImpact: "None",
                  baseScore: 7.5,
                  baseSeverity: "High",
                  confidentialityImpact: "High",
                  exploitabilityScore: null,
                  id: "CVE-2019-10184",
                  impactScore: null,
                  integrityImpact: "None",
                  privilegesRequired: "None",
                  scope: "Unchanged",
                  trust: 0.8,
                  userInteraction: "None",
                  vectorString: "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
                  version: "3.0",
               },
            ],
            severity: [
               {
                  author: "nvd@nist.gov",
                  id: "CVE-2019-10184",
                  trust: 1,
                  value: "HIGH",
               },
               {
                  author: "secalert@redhat.com",
                  id: "CVE-2019-10184",
                  trust: 1,
                  value: "MEDIUM",
               },
               {
                  author: "NVD",
                  id: "CVE-2019-10184",
                  trust: 0.8,
                  value: "High",
               },
               {
                  author: "CNVD",
                  id: "CNVD-2019-24570",
                  trust: 0.6,
                  value: "MEDIUM",
               },
               {
                  author: "CNNVD",
                  id: "CNNVD-201907-1345",
                  trust: 0.6,
                  value: "HIGH",
               },
            ],
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201907-1345",
         },
         {
            db: "NVD",
            id: "CVE-2019-10184",
         },
         {
            db: "NVD",
            id: "CVE-2019-10184",
         },
      ],
   },
   description: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/description#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "undertow before version 2.0.23.Final is vulnerable to an information leak issue. Web apps may have their directory structures predicted through requests without trailing slashes via the api. RedHatUndertow is a Java-based embedded Web server from RedHat, Inc., and is the default web server for Wildfly (Java Application Server). The vulnerability stems from errors in the configuration of the network system or product during operation. An unauthorized attacker can exploit the vulnerability to obtain sensitive information about the affected component. \n\nThe References section of this erratum contains a download link (you must\nlog in to download the update). \n\nThe JBoss server process must be restarted for the update to take effect. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n                   Red Hat Security Advisory\n\nSynopsis:          Important: Red Hat Single Sign-On 7.3.4 security update on RHEL 7\nAdvisory ID:       RHSA-2019:3045-01\nProduct:           Red Hat Single Sign-On\nAdvisory URL:      https://access.redhat.com/errata/RHSA-2019:3045\nIssue date:        2019-10-14\nCVE Names:         CVE-2019-10184 CVE-2019-12086 CVE-2019-12814 \n                   CVE-2019-14379 CVE-2019-14820 CVE-2019-14832 \n=====================================================================\n\n1. Summary:\n\nNew Red Hat Single Sign-On 7.3.4 packages are now available for Red Hat\nEnterprise Linux 7. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRed Hat Single Sign-On 7.3 for RHEL 7 Server - noarch, x86_64\n\n3. Description:\n\nRed Hat Single Sign-On 7.3 is a standalone server, based on the Keycloak\nproject, that provides authentication and standards-based single sign-on\ncapabilities for web and mobile applications. \n\nThis release of Red Hat Single Sign-On 7.3.4 on RHEL 7 serves as a\nreplacement for Red Hat Single Sign-On 7.3.3, and includes bug fixes and\nenhancements, which are documented in the Release Notes document linked to\nin the References. \n\nSecurity Fix(es):\n\n* keycloak: cross-realm user access auth bypass (CVE-2019-14832)\n\n* keycloak: adapter endpoints are exposed via arbitrary URLs\n(CVE-2019-14820)\n\n* jackson-databind: polymorphic typing issue allows attacker to read\narbitrary local files on the server via crafted JSON message\n(CVE-2019-12814)\n\n* jackson-databind: default typing mishandling leading to remote code\nexecution (CVE-2019-14379)\n\n* jackson-databind: polymorphic typing issue allows attacker to read\narbitrary local files on the server (CVE-2019-12086)\n\n* undertow: Information leak in requests for directories without trailing\nslashes (CVE-2019-10184)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, and other related information, refer to the CVE page(s) listed in\nthe References section. \n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1649870 - CVE-2019-14820 keycloak: adapter endpoints are exposed via arbitrary URLs\n1713068 - CVE-2019-10184 undertow: Information leak in requests for directories without trailing slashes\n1713468 - CVE-2019-12086 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. \n1725795 - CVE-2019-12814 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. \n1737517 - CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution\n1749487 - CVE-2019-14832 keycloak: cross-realm user access auth bypass\n\n6. JIRA issues fixed (https://issues.jboss.org/):\n\nKEYCLOAK-11455 - Tracker bug for the RH-SSO 7.3.4 release for RHEL7\n\n7. Package List:\n\nRed Hat Single Sign-On 7.3 for RHEL 7 Server:\n\nSource:\nrh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el7sso.src.rpm\nrh-sso7-libunix-dbus-java-0.8.0-2.el7sso.src.rpm\n\nnoarch:\nrh-sso7-keycloak-4.8.13-1.Final_redhat_00001.1.el7sso.noarch.rpm\nrh-sso7-keycloak-server-4.8.13-1.Final_redhat_00001.1.el7sso.noarch.rpm\n\nx86_64:\nrh-sso7-libunix-dbus-java-0.8.0-2.el7sso.x86_64.rpm\nrh-sso7-libunix-dbus-java-debuginfo-0.8.0-2.el7sso.x86_64.rpm\nrh-sso7-libunix-dbus-java-devel-0.8.0-2.el7sso.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security.  Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n8. References:\n\nhttps://access.redhat.com/security/cve/CVE-2019-10184\nhttps://access.redhat.com/security/cve/CVE-2019-12086\nhttps://access.redhat.com/security/cve/CVE-2019-12814\nhttps://access.redhat.com/security/cve/CVE-2019-14379\nhttps://access.redhat.com/security/cve/CVE-2019-14820\nhttps://access.redhat.com/security/cve/CVE-2019-14832\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/\n\n9. Contact:\n\nThe Red Hat security contact is <secalert@redhat.com>. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2019 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXaS+uNzjgjWX9erEAQjtDg//d/4/1zudIgOeuPCs/B8ZCuh7ec/AKLRi\ndtHZHHLi9Sya+OpHxR57uoLmNAE7KROOuM/belMp+D8joZfzPED/yCVs7g052BXK\nHZ6faa/5TFD0rFY0Bv3gddYsjnjDLRGMW6j3BhpTnln8gShj+sGCVI1AESYykFJR\nPZf82VqYcUWZyKheCPFo3ckHys14jQkOYAldBMqjNNpmhL16O/gT4Urw2OBHwgMa\niSFVRuIvRYZi0XQcHJAtAh+rHG2mbfY2S6qQhIESVPFOd5z8Rj2g/K4PQmCra4Uq\n0vY4zPno78XMrbArJnH4dkfKObW8+EJ1295X33uJAStf/xX9UINeOzvq4i3CLOY4\naw67sqC1YPpQMpfRz1mlPdEmayv/hIBnycKqo0ehgxgwOq59QZrlqvWtxZrat0tS\nsf2th+hcOceglD9yLi7Zz/hLrFRjLS+c1KvI6Ho824Atu2Kfc7NdayT9JRJC7LUa\n16NcMJj804E3vPVf1/YMAL852pOdfNgyFHBB3GTDbog0lVwbBxBiu6sgI8SKtYBA\nznUp1YAQiT4uWBu9cVSmLDPLWT+eLtnuYnRNgOyKYA6nEoqG2G4UKOQHDpaQ9Tn9\nvzJvODlDvf/jQ4LnWscVGXy9EYoXcrFgSGaTb+y3zE8/rlOBUHTKW67FuVag3P7p\nRF7KTszoe+Y=\n=nzBy\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n. JIRA issues fixed (https://issues.jboss.org/):\n\nJBEAP-16455 - [GSS](7.2.z) Upgrade Infinispan from 9.3.6 to 9.3.7\nJBEAP-16779 - [GSS](7.2.z) Upgrade Hibernate ORM from 5.3.10 to 5.3.11\nJBEAP-17045 - [GSS](7.2.z) Upgrade JSF based on Mojarra 2.3.5.SP3-redhat-00001 to 2.3.5.SP3-redhat-00002\nJBEAP-17062 - [GSS](7.2.z) Upgrade Artemis from 2.7.0.redhat-00057 to 2.9.0.redhat-00005\nJBEAP-17073 - [GSS](7.2.z) Upgrade jboss-ejb-client from 4.0.20 to 4.0.23\nJBEAP-17109 - (7.2.z) Upgrade XNIO from 3.6.6.Final-redhat-00001 to 3.7.3.Final-redhat-00001\nJBEAP-17112 - [GSS](7.2.z) Upgrade JBoss Remoting from 5.0.12 to 5.0.14.SP1\nJBEAP-17144 - Tracker bug for the EAP 7.2.4 release for RHEL-8\nJBEAP-17162 - [GSS](7.2.z) Upgrade jgroups from 4.0.19 to 4.0.20\nJBEAP-17178 - (7.2.z) Upgrade IronJacamar from 1.4.16.Final to 1.4.17.Final\nJBEAP-17182 - (7.2.z) Upgrade PicketLink from 2.5.5.SP12-redhat-00006 to 2.5.5.SP12-redhat-00007\nJBEAP-17183 - (7.2.z) Upgrade PicketLink bindings from 2.5.5.SP12-redhat-00006 to 2.5.5.SP12-redhat-00007\nJBEAP-17223 - [GSS](7.2.z) Upgrade WildFly Core from 6.0.15 to 6.0.16\nJBEAP-17238 - [GSS](7.2.z) Upgrade HAL from 3.0.13 to 3.0.16\nJBEAP-17250 - [GSS](7.2.z) Upgrade JBoss MSC from 1.4.5 to 1.4.8\nJBEAP-17271 - [GSS](7.2.z) Upgrade jboss-logmanager from 2.1.7.Final-redhat-00001 to 2.1.14.Final-redhat-00001\nJBEAP-17273 - [GSS](7.2.z) Upgrade jboss-logging from 3.3.2.Final-redhat-00001 to 3.3.3.Final-redhat-00001\nJBEAP-17274 - [GSS](7.2.z) Upgrade Wildfly Elytron from 1.6.3.Final-redhat-00001 to 1.6.4.Final-redhat-00001\nJBEAP-17276 - [GSS](7.2.z) Upgrade wildfly-transaction-client from 1.1.4.Final-redhat-00001 to 1.1.6.Final-redhat-00001\nJBEAP-17277 - [GSS](7.2.z) Upgrade Undertow from 2.0.22 to 2.0.25.SP1\nJBEAP-17278 - [GSS](7.2.z) Upgrade JBoss Marshalling from 2.0.7 to 2.0.9\nJBEAP-17294 - [GSS](7.2.z) Upgrade weld from 3.0.6.Final-redhat-00001 to 3.0.6.Final-redhat-00002\nJBEAP-17311 - [GSS](7.2.z) Upgrade jboss-jaxrs-api_2.1_spec from 1.0.1.Final-redhat-00001 to 1.0.3.Final-redhat-00001\nJBEAP-17320 - [GSS](7.2.z) Upgrade PicketBox from 5.0.3.Final-redhat-3 to 5.0.3.Final-redhat-00004\nJBEAP-17321 - [GSS](7.2.z) Upgrade Narayana from 5.9.3.Final to 5.9.6.Final\nJBEAP-17334 - (7.2.z) Upgrade Elytron-Tool from 1.4.2 to 1.4.3.Final\nJBEAP-17527 - [GSS](7.2.z) Upgrade Hibernate ORM from 5.3.11 to 5.3.11.SP1\n\n7",
      sources: [
         {
            db: "NVD",
            id: "CVE-2019-10184",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
         {
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
         {
            db: "PACKETSTORM",
            id: "154845",
         },
         {
            db: "PACKETSTORM",
            id: "154686",
         },
         {
            db: "PACKETSTORM",
            id: "154687",
         },
         {
            db: "PACKETSTORM",
            id: "154850",
         },
         {
            db: "PACKETSTORM",
            id: "154844",
         },
         {
            db: "PACKETSTORM",
            id: "154793",
         },
         {
            db: "PACKETSTORM",
            id: "154665",
         },
      ],
      trust: 2.79,
   },
   external_ids: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/external_ids#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            db: "NVD",
            id: "CVE-2019-10184",
            trust: 3.7,
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
            trust: 0.8,
         },
         {
            db: "PACKETSTORM",
            id: "154793",
            trust: 0.7,
         },
         {
            db: "PACKETSTORM",
            id: "154665",
            trust: 0.7,
         },
         {
            db: "CNVD",
            id: "CNVD-2019-24570",
            trust: 0.6,
         },
         {
            db: "PACKETSTORM",
            id: "156941",
            trust: 0.6,
         },
         {
            db: "PACKETSTORM",
            id: "156628",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2019.3672",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2020.1076",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2019.3805",
            trust: 0.6,
         },
         {
            db: "AUSCERT",
            id: "ESB-2020.0832",
            trust: 0.6,
         },
         {
            db: "CNNVD",
            id: "CNNVD-201907-1345",
            trust: 0.6,
         },
         {
            db: "PACKETSTORM",
            id: "154845",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "154686",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "154687",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "154850",
            trust: 0.1,
         },
         {
            db: "PACKETSTORM",
            id: "154844",
            trust: 0.1,
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
         {
            db: "PACKETSTORM",
            id: "154845",
         },
         {
            db: "PACKETSTORM",
            id: "154686",
         },
         {
            db: "PACKETSTORM",
            id: "154687",
         },
         {
            db: "PACKETSTORM",
            id: "154850",
         },
         {
            db: "PACKETSTORM",
            id: "154844",
         },
         {
            db: "PACKETSTORM",
            id: "154793",
         },
         {
            db: "PACKETSTORM",
            id: "154665",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201907-1345",
         },
         {
            db: "NVD",
            id: "CVE-2019-10184",
         },
      ],
   },
   id: "VAR-201907-1547",
   iot: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/iot#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: true,
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
      ],
      trust: 1.6,
   },
   iot_taxonomy: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            category: [
               "Network device",
            ],
            sub_category: null,
            trust: 0.6,
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
      ],
   },
   last_update_date: "2024-11-29T22:17:29.680000Z",
   patch: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/patch#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            title: "[UNDERTOW-1578] 401 Unauthorized should be returned when requesting a protected directory without trailing slash #794",
            trust: 0.8,
            url: "https://github.com/undertow-io/undertow/pull/794",
         },
         {
            title: "Bug 1713068",
            trust: 0.8,
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10184",
         },
         {
            title: "Patch for RedHatUndertow Information Disclosure Vulnerability (CNVD-2019-24570)",
            trust: 0.6,
            url: "https://www.cnvd.org.cn/patchInfo/show/172059",
         },
         {
            title: "Red Hat Undertow Repair measures for information disclosure vulnerabilities",
            trust: 0.6,
            url: "http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=95492",
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201907-1345",
         },
      ],
   },
   problemtype_data: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            problemtype: "CWE-862",
            trust: 1,
         },
         {
            problemtype: "CWE-200",
            trust: 0.8,
         },
      ],
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
         {
            db: "NVD",
            id: "CVE-2019-10184",
         },
      ],
   },
   references: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/references#",
         data: {
            "@container": "@list",
         },
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: [
         {
            trust: 2.7,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-10184",
         },
         {
            trust: 2.3,
            url: "https://access.redhat.com/errata/rhsa-2019:3046",
         },
         {
            trust: 2.3,
            url: "https://access.redhat.com/errata/rhsa-2019:2936",
         },
         {
            trust: 2.3,
            url: "https://access.redhat.com/errata/rhsa-2019:2938",
         },
         {
            trust: 2.3,
            url: "https://access.redhat.com/errata/rhsa-2019:3050",
         },
         {
            trust: 2.3,
            url: "https://access.redhat.com/errata/rhsa-2019:3045",
         },
         {
            trust: 2.3,
            url: "https://access.redhat.com/errata/rhsa-2019:2937",
         },
         {
            trust: 2.2,
            url: "https://access.redhat.com/errata/rhsa-2019:2935",
         },
         {
            trust: 2.2,
            url: "https://access.redhat.com/errata/rhsa-2019:3044",
         },
         {
            trust: 1.7,
            url: "https://access.redhat.com/errata/rhsa-2019:2998",
         },
         {
            trust: 1.6,
            url: "https://bugzilla.redhat.com/show_bug.cgi?id=cve-2019-10184",
         },
         {
            trust: 1.6,
            url: "https://access.redhat.com/errata/rhsa-2020:0727",
         },
         {
            trust: 1.6,
            url: "https://github.com/undertow-io/undertow/pull/794",
         },
         {
            trust: 1.6,
            url: "https://security.netapp.com/advisory/ntap-20220210-0016/",
         },
         {
            trust: 0.8,
            url: "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-10184",
         },
         {
            trust: 0.7,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-14379",
         },
         {
            trust: 0.7,
            url: "https://access.redhat.com/security/cve/cve-2019-10184",
         },
         {
            trust: 0.7,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-12086",
         },
         {
            trust: 0.7,
            url: "https://access.redhat.com/security/updates/classification/#important",
         },
         {
            trust: 0.7,
            url: "https://access.redhat.com/security/team/contact/",
         },
         {
            trust: 0.7,
            url: "https://www.redhat.com/mailman/listinfo/rhsa-announce",
         },
         {
            trust: 0.7,
            url: "https://bugzilla.redhat.com/):",
         },
         {
            trust: 0.7,
            url: "https://access.redhat.com/security/cve/cve-2019-12086",
         },
         {
            trust: 0.7,
            url: "https://access.redhat.com/security/cve/cve-2019-14379",
         },
         {
            trust: 0.6,
            url: "https://issues.jboss.org/):",
         },
         {
            trust: 0.6,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-12814",
         },
         {
            trust: 0.6,
            url: "https://access.redhat.com/security/cve/cve-2019-12814",
         },
         {
            trust: 0.6,
            url: "https://vigilance.fr/vulnerability/undertow-information-disclosure-via-trailing-slashes-30482",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2019.3805/",
         },
         {
            trust: 0.6,
            url: "https://packetstormsecurity.com/files/154793/red-hat-security-advisory-2019-2998-01.html",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2020.0832/",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2020.1076/",
         },
         {
            trust: 0.6,
            url: "https://packetstormsecurity.com/files/156628/red-hat-security-advisory-2020-0727-01.html",
         },
         {
            trust: 0.6,
            url: "https://packetstormsecurity.com/files/156941/red-hat-security-advisory-2020-0983-01.html",
         },
         {
            trust: 0.6,
            url: "https://packetstormsecurity.com/files/154665/red-hat-security-advisory-2019-2937-01.html",
         },
         {
            trust: 0.6,
            url: "https://www.auscert.org.au/bulletins/esb-2019.3672/",
         },
         {
            trust: 0.4,
            url: "https://access.redhat.com/articles/11258",
         },
         {
            trust: 0.4,
            url: "https://access.redhat.com/security/team/key/",
         },
         {
            trust: 0.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-10212",
         },
         {
            trust: 0.4,
            url: "https://access.redhat.com/security/cve/cve-2019-10212",
         },
         {
            trust: 0.4,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-12384",
         },
         {
            trust: 0.4,
            url: "https://access.redhat.com/security/cve/cve-2019-12384",
         },
         {
            trust: 0.3,
            url: "https://access.redhat.com/security/cve/cve-2019-14832",
         },
         {
            trust: 0.3,
            url: "https://access.redhat.com/documentation/en-us/red_hat_single_sign-on/7.3/",
         },
         {
            trust: 0.3,
            url: "https://access.redhat.com/security/cve/cve-2019-14820",
         },
         {
            trust: 0.3,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-14832",
         },
         {
            trust: 0.3,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-14820",
         },
         {
            trust: 0.3,
            url: "https://access.redhat.com/security/cve/cve-2019-10202",
         },
         {
            trust: 0.3,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-10202",
         },
         {
            trust: 0.3,
            url: "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/installation_guide/",
         },
         {
            trust: 0.3,
            url: "https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=appplatform&downloadtype=securitypatches&version=7.2",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?product=core.service.rhsso&downloadtype=securitypatches&version=7.3",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/security/cve/cve-2019-3888",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/security/cve/cve-2019-3868",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/jbossnetwork/restricted/listsoftware.html?downloadtype=distributions&product\\xcatrhoar.thorntail&version=2.5.0",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-3888",
         },
         {
            trust: 0.1,
            url: "https://nvd.nist.gov/vuln/detail/cve-2019-3868",
         },
         {
            trust: 0.1,
            url: "https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html/release_notes_for_thorntail_2/",
         },
      ],
      sources: [
         {
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
         {
            db: "PACKETSTORM",
            id: "154845",
         },
         {
            db: "PACKETSTORM",
            id: "154686",
         },
         {
            db: "PACKETSTORM",
            id: "154687",
         },
         {
            db: "PACKETSTORM",
            id: "154850",
         },
         {
            db: "PACKETSTORM",
            id: "154844",
         },
         {
            db: "PACKETSTORM",
            id: "154793",
         },
         {
            db: "PACKETSTORM",
            id: "154665",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201907-1345",
         },
         {
            db: "NVD",
            id: "CVE-2019-10184",
         },
      ],
   },
   sources: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
         {
            db: "PACKETSTORM",
            id: "154845",
         },
         {
            db: "PACKETSTORM",
            id: "154686",
         },
         {
            db: "PACKETSTORM",
            id: "154687",
         },
         {
            db: "PACKETSTORM",
            id: "154850",
         },
         {
            db: "PACKETSTORM",
            id: "154844",
         },
         {
            db: "PACKETSTORM",
            id: "154793",
         },
         {
            db: "PACKETSTORM",
            id: "154665",
         },
         {
            db: "CNNVD",
            id: "CNNVD-201907-1345",
         },
         {
            db: "NVD",
            id: "CVE-2019-10184",
         },
      ],
   },
   sources_release_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2019-07-29T00:00:00",
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
         {
            date: "2019-08-05T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
         {
            date: "2019-10-14T23:03:33",
            db: "PACKETSTORM",
            id: "154845",
         },
         {
            date: "2019-09-30T16:22:22",
            db: "PACKETSTORM",
            id: "154686",
         },
         {
            date: "2019-09-30T18:22:22",
            db: "PACKETSTORM",
            id: "154687",
         },
         {
            date: "2019-10-15T00:11:31",
            db: "PACKETSTORM",
            id: "154850",
         },
         {
            date: "2019-10-14T20:33:33",
            db: "PACKETSTORM",
            id: "154844",
         },
         {
            date: "2019-10-10T14:44:58",
            db: "PACKETSTORM",
            id: "154793",
         },
         {
            date: "2019-09-30T19:22:22",
            db: "PACKETSTORM",
            id: "154665",
         },
         {
            date: "2019-07-25T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201907-1345",
         },
         {
            date: "2019-07-25T21:15:11.473000",
            db: "NVD",
            id: "CVE-2019-10184",
         },
      ],
   },
   sources_update_date: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
         data: {
            "@container": "@list",
         },
      },
      data: [
         {
            date: "2019-07-29T00:00:00",
            db: "CNVD",
            id: "CNVD-2019-24570",
         },
         {
            date: "2019-08-05T00:00:00",
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
         {
            date: "2022-03-10T00:00:00",
            db: "CNNVD",
            id: "CNNVD-201907-1345",
         },
         {
            date: "2024-11-21T04:18:36.287000",
            db: "NVD",
            id: "CVE-2019-10184",
         },
      ],
   },
   threat_type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/threat_type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "remote",
      sources: [
         {
            db: "CNNVD",
            id: "CNNVD-201907-1345",
         },
      ],
      trust: 0.6,
   },
   title: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/title#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "undertow Vulnerable to information disclosure",
      sources: [
         {
            db: "JVNDB",
            id: "JVNDB-2019-007209",
         },
      ],
      trust: 0.8,
   },
   type: {
      "@context": {
         "@vocab": "https://www.variotdbs.pl/ref/type#",
         sources: {
            "@container": "@list",
            "@context": {
               "@vocab": "https://www.variotdbs.pl/ref/sources#",
            },
         },
      },
      data: "code execution",
      sources: [
         {
            db: "PACKETSTORM",
            id: "154845",
         },
         {
            db: "PACKETSTORM",
            id: "154686",
         },
         {
            db: "PACKETSTORM",
            id: "154687",
         },
         {
            db: "PACKETSTORM",
            id: "154850",
         },
         {
            db: "PACKETSTORM",
            id: "154844",
         },
         {
            db: "PACKETSTORM",
            id: "154793",
         },
         {
            db: "PACKETSTORM",
            id: "154665",
         },
      ],
      trust: 0.7,
   },
}


Log in or create an account to share your comment.

Security Advisory comment format.

This schema specifies the format of a comment related to a security advisory.

UUIDv4 of the comment
UUIDv4 of the Vulnerability-Lookup instance
When the comment was created originally
When the comment was last updated
Title of the comment
Description of the comment
The identifier of the vulnerability (CVE ID, GHSA-ID, PYSEC ID, etc.).



Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.