CVE-2019-17195
Fixed in a distro release EPSS 11%
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
Products: connect2id nimbus_jose+jwt, apache hadoop, oracle communications_cloud_native_core_security_edge_protection_proxy, oracle communications_pricing_design_center, oracle data_integrator, oracle enterprise_manager_base_platform, oracle healthcare_data_repository, oracle insurance_policy_administration, oracle jd_edwards_enterpriseone_orchestrator, oracle jd_edwards_enterpriseone_tools, oracle peoplesoft_enterprise_peopletools, oracle policy_automation, oracle primavera_gateway, oracle solaris_cluster, oracle weblogic_server
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | com.nimbusds:nimbus-jose-jwt | 7.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 7 | apache-commons-beanutils | 0:1.8.3-15.el7_7 |
| Red Hat Enterprise Linux 7 | apache-commons-beanutils-javadoc | 0:1.8.3-15.el7_7 |
| Red Hat rhev manager 4.3 | ovirt-engine | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-backend | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-dbscripts | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-extension-aaa-misc | 0:1.0.4-1.el7ev |
| Red Hat rhev manager 4.3 | ovirt-engine-extensions-api-impl | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-extensions-api-impl-javadoc | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-health-check-bundler | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-restapi | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-setup | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-setup-base | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-setup-plugin-cinderlib | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-setup-plugin-ovirt-engine | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-setup-plugin-ovirt-engine-common | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-setup-plugin-vmconsole-proxy-helper | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-setup-plugin-websocket-proxy | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-tools | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-tools-backup | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-vmconsole-proxy-helper | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-webadmin-portal | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-engine-websocket-proxy | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | ovirt-fast-forward-upgrade | 0:1.0.0-17.el7ev |
| Red Hat rhev manager 4.3 | python2-ovirt-engine-lib | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | rhvm | 0:4.3.9.3-0.1.el7 |
| Red Hat rhev manager 4.3 | rhvm-dependencies | 0:4.3.2-1.el7ev |