製品・ソフトウェアに関する情報

JVN脆弱性詳細

Cosminexus における複数の脆弱性

Title	Cosminexus における複数の脆弱性
Summary	Cosminexus Developer's Kit for Java および Hitachi Developer's Kit for Java には、下記の脆弱性が存在します。 CVE-2019-2602, CVE-2019-2684, CVE-2019-2697, CVE-2019-2698
Possible impacts	想定される影響については、ベンダ情報をご確認ください。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	April 24, 2019, midnight
Registration Date	April 25, 2019, 2:06 p.m.
Last Update	April 25, 2019, 2:06 p.m.

Affected System

日立

uCosminexus Application Server

uCosminexus Application Server (64)

uCosminexus Client

uCosminexus Developer

uCosminexus Service Architect

uCosminexus Service Platform

uCosminexus Service Platform (64)

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2019-2602	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2602
2	CVE-2019-2684	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2684
3	CVE-2019-2697	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2697
4	CVE-2019-2698	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2698
National Vulnerability Database (NVD)
5	CVE-2019-2602	https://nvd.nist.gov/vuln/detail/CVE-2019-2602
6	CVE-2019-2684	https://nvd.nist.gov/vuln/detail/CVE-2019-2684
7	CVE-2019-2697	https://nvd.nist.gov/vuln/detail/CVE-2019-2697
8	CVE-2019-2698	https://nvd.nist.gov/vuln/detail/CVE-2019-2698

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-noinfo	https://www.ipa.go.jp/security/vuln/CWE.html#CWEnoinfo

ベンダー情報

No	Name	URL
Hitachi Software Vulnerability Information
1	hitachi-sec-2019-109	http://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2019-109/index.html
ソフトウェア製品セキュリティ情報
2	hitachi-sec-2019-109	http://www.hitachi.co.jp/Prod/comp/soft1/security/info/vuls/hitachi-sec-2019-109/index.html

Change Log

No	Changed Details	Date of change
1	[2019年04月25日] 掲載	April 25, 2019, 11:59 a.m.

NVD Vulnerability Information

CVE-2019-2602

Summary	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Easily exploitable vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Java SE, Java SE Embedded. Note: This vulnerability can only be exploited by supplying data to APIs in the specified Component without using Untrusted Java Web Start applications or Untrusted Java applets, such as through a web service. CVSS 3.0 Base Score 7.5 (Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Publication Date	April 24, 2019, 4:32 a.m.
Registration Date	Jan. 26, 2021, 11:42 a.m.
Last Update	Nov. 21, 2024, 1:41 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk:11.0.2:::::::*
cpe:2.3:a:oracle:jdk:12:::::::*
cpe:2.3:a:oracle:jre:11.0.2:::::::*
cpe:2.3:a:oracle:jre:12:::::::*
cpe:2.3:a:oracle:jdk:1.8.0:update201::::::
cpe:2.3:a:oracle:jdk:1.8.0:update202::::::
cpe:2.3:a:oracle:jdk:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.8.0:update201::::::
cpe:2.3:a:oracle:jre:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.8.0:update202::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:a:redhat:satellite:5.8:::::::*
cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:42.3:::::::*
cpe:2.3:o:opensuse:leap:15.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:19.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::

Configuration5	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration6	or higher	or less	more than	less than
cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.0:::::::*
cpe:2.3:a:mcafee:epolicy_orchestrator:5.9.1:::::::*
cpe:2.3:a:mcafee:epolicy_orchestrator:5.10.0:-::::::

Configuration7		or higher	or less	more than	less than
cpe:2.3:a:hp:xp7_command_view:::::advanced:::*					8.6.5-00

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.html	Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.html	Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html	Mailing List Third Party Advisory
9	http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Vendor Advisory
10	http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Vendor Advisory
11	https://access.redhat.com/errata/RHBA-2019:0959	Third Party Advisory
12	https://access.redhat.com/errata/RHBA-2019:0959	Third Party Advisory
13	https://access.redhat.com/errata/RHSA-2019:1146	Third Party Advisory
14	https://access.redhat.com/errata/RHSA-2019:1146	Third Party Advisory
15	https://access.redhat.com/errata/RHSA-2019:1163	Third Party Advisory
16	https://access.redhat.com/errata/RHSA-2019:1163	Third Party Advisory
17	https://access.redhat.com/errata/RHSA-2019:1164	Third Party Advisory
18	https://access.redhat.com/errata/RHSA-2019:1164	Third Party Advisory
19	https://access.redhat.com/errata/RHSA-2019:1165	Third Party Advisory
20	https://access.redhat.com/errata/RHSA-2019:1165	Third Party Advisory
21	https://access.redhat.com/errata/RHSA-2019:1166	Third Party Advisory
22	https://access.redhat.com/errata/RHSA-2019:1166	Third Party Advisory
23	https://access.redhat.com/errata/RHSA-2019:1238	Third Party Advisory
24	https://access.redhat.com/errata/RHSA-2019:1238	Third Party Advisory
25	https://access.redhat.com/errata/RHSA-2019:1325	Third Party Advisory
26	https://access.redhat.com/errata/RHSA-2019:1325	Third Party Advisory
27	https://access.redhat.com/errata/RHSA-2019:1518	Third Party Advisory
28	https://access.redhat.com/errata/RHSA-2019:1518	Third Party Advisory
29	https://kc.mcafee.com/corporate/index?page=content&id=SB10285	Third Party Advisory
30	https://kc.mcafee.com/corporate/index?page=content&id=SB10285	Third Party Advisory
31	https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html	Mailing List Third Party Advisory
32	https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html	Mailing List Third Party Advisory
33	https://seclists.org/bugtraq/2019/May/75	Mailing List Third Party Advisory
34	https://seclists.org/bugtraq/2019/May/75	Mailing List Third Party Advisory
35	https://security.gentoo.org/glsa/201908-10	Third Party Advisory
36	https://security.gentoo.org/glsa/201908-10	Third Party Advisory
37	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us	Third Party Advisory
38	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us	Third Party Advisory
39	https://usn.ubuntu.com/3975-1/	Third Party Advisory
40	https://usn.ubuntu.com/3975-1/	Third Party Advisory
41	https://www.debian.org/security/2019/dsa-4453	Third Party Advisory
42	https://www.debian.org/security/2019/dsa-4453	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-400	リソースの枯渇	https://cwe.mitre.org/data/definitions/400.html

CVE-2019-2684

Summary	Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202, 11.0.2 and 12; Java SE Embedded: 8u201. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE, Java SE Embedded. Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Java SE, Java SE Embedded accessible data. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability can also be exploited by using APIs in the specified Component, e.g., through a web service which supplies data to the APIs. CVSS 3.0 Base Score 5.9 (Integrity impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N).
Publication Date	April 24, 2019, 4:32 a.m.
Registration Date	Jan. 26, 2021, 11:42 a.m.
Last Update	Nov. 21, 2024, 1:41 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk:11.0.2:::::::*
cpe:2.3:a:oracle:jdk:12:::::::*
cpe:2.3:a:oracle:jre:11.0.2:::::::*
cpe:2.3:a:oracle:jre:12:::::::*
cpe:2.3:a:oracle:jdk:1.8.0:update201::::::
cpe:2.3:a:oracle:jdk:1.8.0:update202::::::
cpe:2.3:a:oracle:jdk:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.8.0:update201::::::
cpe:2.3:a:oracle:jre:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.8.0:update202::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:a:redhat:satellite:5.8:::::::*
cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:42.3:::::::*
cpe:2.3:o:opensuse:leap:15.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat::::::::	7.0.0	7.0.97
cpe:2.3:a:apache:tomcat::::::::	8.5.0	8.5.47
cpe:2.3:a:apache:tomcat:9.0.0:milestone1::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone10::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone11::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone12::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone13::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone14::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone15::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone16::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone17::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone18::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone19::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone2::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone20::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone21::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone22::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone23::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone24::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone25::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone26::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone27::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone3::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone4::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone5::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone6::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone7::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone8::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone9::::::
cpe:2.3:a:apache:cassandra:4.0.0:beta1::::::
cpe:2.3:a:apache:cassandra::::::::	3.11.0			3.11.8
cpe:2.3:a:apache:cassandra::::::::	3.0.0			3.0.22
cpe:2.3:a:apache:cassandra::::::::	2.2.0			2.2.18
cpe:2.3:a:apache:cassandra::::::::	2.1.0			2.1.22
cpe:2.3:a:apache:tomcat::::::::	9.0.1	9.0.28

Configuration6	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::

Configuration7		or higher	or less	more than	less than
cpe:2.3:a:hp:xp7_command_view:::::advanced:::*					8.6.5-00

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.html	Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00007.html	Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html	Mailing List Third Party Advisory
7	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html	Mailing List Third Party Advisory
8	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html	Mailing List Third Party Advisory
9	http://www.openwall.com/lists/oss-security/2020/09/01/4	Mailing List Third Party Advisory
10	http://www.openwall.com/lists/oss-security/2020/09/01/4	Mailing List Third Party Advisory
11	http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Vendor Advisory
12	http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Vendor Advisory
13	https://access.redhat.com/errata/RHBA-2019:0959	Mailing List Third Party Advisory
14	https://access.redhat.com/errata/RHBA-2019:0959	Mailing List Third Party Advisory
15	https://access.redhat.com/errata/RHSA-2019:1146	Third Party Advisory
16	https://access.redhat.com/errata/RHSA-2019:1146	Third Party Advisory
17	https://access.redhat.com/errata/RHSA-2019:1163	Third Party Advisory
18	https://access.redhat.com/errata/RHSA-2019:1163	Third Party Advisory
19	https://access.redhat.com/errata/RHSA-2019:1164	Third Party Advisory
20	https://access.redhat.com/errata/RHSA-2019:1164	Third Party Advisory
21	https://access.redhat.com/errata/RHSA-2019:1165	Third Party Advisory
22	https://access.redhat.com/errata/RHSA-2019:1165	Third Party Advisory
23	https://access.redhat.com/errata/RHSA-2019:1166	Third Party Advisory
24	https://access.redhat.com/errata/RHSA-2019:1166	Third Party Advisory
25	https://access.redhat.com/errata/RHSA-2019:1238	Third Party Advisory
26	https://access.redhat.com/errata/RHSA-2019:1238	Third Party Advisory
27	https://access.redhat.com/errata/RHSA-2019:1325	Third Party Advisory
28	https://access.redhat.com/errata/RHSA-2019:1325	Third Party Advisory
29	https://access.redhat.com/errata/RHSA-2019:1518	Third Party Advisory
30	https://access.redhat.com/errata/RHSA-2019:1518	Third Party Advisory
31	https://lists.apache.org/thread.html/38a01302c92ae513910d8c851a2d111736565bd698be4e3af3e4c063%40%3Cdev.tomcat.apache.org%3E
32	https://lists.apache.org/thread.html/38a01302c92ae513910d8c851a2d111736565bd698be4e3af3e4c063%40%3Cdev.tomcat.apache.org%3E
33	https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E
34	https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E
35	https://lists.apache.org/thread.html/71bd3e4e222479c266eaafc8d0c171ef5782a69b52f68df11b650ed7%40%3Cusers.tomcat.apache.org%3E
36	https://lists.apache.org/thread.html/71bd3e4e222479c266eaafc8d0c171ef5782a69b52f68df11b650ed7%40%3Cusers.tomcat.apache.org%3E
37	https://lists.apache.org/thread.html/c58d6c3b49c615916b163809f963a55421cac2264885739508e68108%40%3Cannounce.apache.org%3E
38	https://lists.apache.org/thread.html/c58d6c3b49c615916b163809f963a55421cac2264885739508e68108%40%3Cannounce.apache.org%3E
39	https://lists.apache.org/thread.html/f7f54b4888060d99f59993f006e25005a2b58db0c07ff866bdcd6f17%40%3Cdev.tomcat.apache.org%3E
40	https://lists.apache.org/thread.html/f7f54b4888060d99f59993f006e25005a2b58db0c07ff866bdcd6f17%40%3Cdev.tomcat.apache.org%3E
41	https://lists.apache.org/thread.html/r1fd117082b992e7d43c1286e966c285f98aa362e685695d999ff42f7%40%3Cuser.cassandra.apache.org%3E
42	https://lists.apache.org/thread.html/r1fd117082b992e7d43c1286e966c285f98aa362e685695d999ff42f7%40%3Cuser.cassandra.apache.org%3E
43	https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
44	https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d%40%3Cdev.tomcat.apache.org%3E
45	https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
46	https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0%40%3Cdev.tomcat.apache.org%3E
47	https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
48	https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9%40%3Cdev.tomcat.apache.org%3E
49	https://lists.apache.org/thread.html/r718e01f61b35409a4f7a3ccbc1cb5136a1558a9f9c2cb8d4ca9be1ce%40%3Cuser.cassandra.apache.org%3E
50	https://lists.apache.org/thread.html/r718e01f61b35409a4f7a3ccbc1cb5136a1558a9f9c2cb8d4ca9be1ce%40%3Cuser.cassandra.apache.org%3E
51	https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
52	https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c%40%3Cdev.tomcat.apache.org%3E
53	https://lists.apache.org/thread.html/rab8d90d28f944d84e4d7852f355a25c89451ae02c2decc4d355a9cfc%40%3Cuser.cassandra.apache.org%3E
54	https://lists.apache.org/thread.html/rab8d90d28f944d84e4d7852f355a25c89451ae02c2decc4d355a9cfc%40%3Cuser.cassandra.apache.org%3E
55	https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
56	https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a%40%3Cdev.tomcat.apache.org%3E
57	https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cdev.cassandra.apache.org%3E
58	https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cdev.cassandra.apache.org%3E
59	https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cuser.cassandra.apache.org%3E
60	https://lists.apache.org/thread.html/rcd7544b24d8fc32b7950ec4c117052410b661babaa857fb1fc641152%40%3Cuser.cassandra.apache.org%3E
61	https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html	Third Party Advisory
62	https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html	Third Party Advisory
63	https://seclists.org/bugtraq/2019/May/75	Mailing List Third Party Advisory
64	https://seclists.org/bugtraq/2019/May/75	Mailing List Third Party Advisory
65	https://security.gentoo.org/glsa/201908-10	Third Party Advisory
66	https://security.gentoo.org/glsa/201908-10	Third Party Advisory
67	https://support.f5.com/csp/article/K11175903?utm_source=f5support&amp%3Butm_medium=RSS
68	https://support.f5.com/csp/article/K11175903?utm_source=f5support&amp%3Butm_medium=RSS
69	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us	Third Party Advisory
70	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us	Third Party Advisory
71	https://usn.ubuntu.com/3975-1/	Third Party Advisory
72	https://usn.ubuntu.com/3975-1/	Third Party Advisory
73	https://www.debian.org/security/2019/dsa-4453	Third Party Advisory
74	https://www.debian.org/security/2019/dsa-4453	Third Party Advisory

Common Vulnerabilities List

CVE-2019-2697

Summary	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Publication Date	April 24, 2019, 4:32 a.m.
Registration Date	Jan. 26, 2021, 11:42 a.m.
Last Update	Nov. 21, 2024, 1:41 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk:1.8.0:update202::::::
cpe:2.3:a:oracle:jdk:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.8.0:update202::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:a:redhat:satellite:5.8:::::::*
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::*

Configuration4		or higher	or less	more than	less than
cpe:2.3:a:hp:xp7_command_view:::::advanced:::*					8.6.5-00

Related information, measures and tools

No	URL	タグ
1	http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Vendor Advisory
2	http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Vendor Advisory
3	https://access.redhat.com/errata/RHSA-2019:1163	Third Party Advisory
4	https://access.redhat.com/errata/RHSA-2019:1163	Third Party Advisory
5	https://access.redhat.com/errata/RHSA-2019:1164	Third Party Advisory
6	https://access.redhat.com/errata/RHSA-2019:1164	Third Party Advisory
7	https://access.redhat.com/errata/RHSA-2019:1165	Third Party Advisory
8	https://access.redhat.com/errata/RHSA-2019:1165	Third Party Advisory
9	https://access.redhat.com/errata/RHSA-2019:1166	Third Party Advisory
10	https://access.redhat.com/errata/RHSA-2019:1166	Third Party Advisory
11	https://access.redhat.com/errata/RHSA-2019:1238	Third Party Advisory
12	https://access.redhat.com/errata/RHSA-2019:1238	Third Party Advisory
13	https://access.redhat.com/errata/RHSA-2019:1325	Third Party Advisory
14	https://access.redhat.com/errata/RHSA-2019:1325	Third Party Advisory
15	https://security.gentoo.org/glsa/201908-10	Third Party Advisory
16	https://security.gentoo.org/glsa/201908-10	Third Party Advisory
17	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us	Third Party Advisory
18	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us	Third Party Advisory
19	https://usn.ubuntu.com/3975-1/	Third Party Advisory
20	https://usn.ubuntu.com/3975-1/	Third Party Advisory

Common Vulnerabilities List

CVE-2019-2698

Summary	Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to compromise Java SE. Successful attacks of this vulnerability can result in takeover of Java SE. Note: This vulnerability applies to Java deployments, typically in clients running sandboxed Java Web Start applications or sandboxed Java applets (in Java SE 8), that load and run untrusted code (e.g., code that comes from the internet) and rely on the Java sandbox for security. This vulnerability does not apply to Java deployments, typically in servers, that load and run only trusted code (e.g., code installed by an administrator). CVSS 3.0 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Publication Date	April 24, 2019, 4:32 a.m.
Registration Date	Jan. 26, 2021, 11:42 a.m.
Last Update	Nov. 21, 2024, 1:41 p.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk:1.8.0:update202::::::
cpe:2.3:a:oracle:jdk:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.8.0:update202::::::

Configuration2		or higher	or less	more than	less than
cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:o:debian:debian_linux:8.0:::::::*
cpe:2.3:o:debian:debian_linux:9.0:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:o:opensuse:leap:42.3:::::::*
cpe:2.3:o:opensuse:leap:15.0:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:o:canonical:ubuntu_linux:18.04::::lts:::
cpe:2.3:o:canonical:ubuntu_linux:18.10:::::::*
cpe:2.3:o:canonical:ubuntu_linux:19.04:::::::*
cpe:2.3:o:canonical:ubuntu_linux:16.04::::esm:::

Configuration6	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:a:redhat:satellite:5.8:::::::*
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::*

Configuration7		or higher	or less	more than	less than
cpe:2.3:a:hp:xp7_command_view:::::advanced:::*					8.6.5-00

Related information, measures and tools

No	URL	タグ
1	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html	Mailing List Third Party Advisory
2	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00058.html	Mailing List Third Party Advisory
3	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html	Mailing List Third Party Advisory
4	http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00059.html	Mailing List Third Party Advisory
5	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html	Mailing List Third Party Advisory
6	http://lists.opensuse.org/opensuse-security-announce/2019-06/msg00013.html	Mailing List Third Party Advisory
7	http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Vendor Advisory
8	http://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html	Patch Vendor Advisory
9	https://access.redhat.com/errata/RHBA-2019:0959	Third Party Advisory
10	https://access.redhat.com/errata/RHBA-2019:0959	Third Party Advisory
11	https://access.redhat.com/errata/RHSA-2019:1146	Third Party Advisory
12	https://access.redhat.com/errata/RHSA-2019:1146	Third Party Advisory
13	https://access.redhat.com/errata/RHSA-2019:1163	Third Party Advisory
14	https://access.redhat.com/errata/RHSA-2019:1163	Third Party Advisory
15	https://access.redhat.com/errata/RHSA-2019:1164	Third Party Advisory
16	https://access.redhat.com/errata/RHSA-2019:1164	Third Party Advisory
17	https://access.redhat.com/errata/RHSA-2019:1165	Third Party Advisory
18	https://access.redhat.com/errata/RHSA-2019:1165	Third Party Advisory
19	https://access.redhat.com/errata/RHSA-2019:1166	Third Party Advisory
20	https://access.redhat.com/errata/RHSA-2019:1166	Third Party Advisory
21	https://access.redhat.com/errata/RHSA-2019:1238	Third Party Advisory
22	https://access.redhat.com/errata/RHSA-2019:1238	Third Party Advisory
23	https://access.redhat.com/errata/RHSA-2019:1325	Third Party Advisory
24	https://access.redhat.com/errata/RHSA-2019:1325	Third Party Advisory
25	https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html	Mailing List Third Party Advisory
26	https://lists.debian.org/debian-lts-announce/2019/05/msg00011.html	Mailing List Third Party Advisory
27	https://seclists.org/bugtraq/2019/May/75	Mailing List Third Party Advisory
28	https://seclists.org/bugtraq/2019/May/75	Mailing List Third Party Advisory
29	https://security.gentoo.org/glsa/201908-10	Third Party Advisory
30	https://security.gentoo.org/glsa/201908-10	Third Party Advisory
31	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us	Third Party Advisory
32	https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03959en_us	Third Party Advisory
33	https://usn.ubuntu.com/3975-1/	Third Party Advisory
34	https://usn.ubuntu.com/3975-1/	Third Party Advisory
35	https://www.debian.org/security/2019/dsa-4453	Third Party Advisory
36	https://www.debian.org/security/2019/dsa-4453	Third Party Advisory

Common Vulnerabilities List

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk:11.0.2:::::::*
cpe:2.3:a:oracle:jdk:12:::::::*
cpe:2.3:a:oracle:jre:11.0.2:::::::*
cpe:2.3:a:oracle:jre:12:::::::*
cpe:2.3:a:oracle:jdk:1.8.0:update201::::::
cpe:2.3:a:oracle:jdk:1.8.0:update202::::::
cpe:2.3:a:oracle:jdk:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.8.0:update201::::::
cpe:2.3:a:oracle:jre:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.8.0:update202::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:a:redhat:satellite:5.8:::::::*
cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::*

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:oracle:jdk:11.0.2:::::::*
cpe:2.3:a:oracle:jdk:12:::::::*
cpe:2.3:a:oracle:jre:11.0.2:::::::*
cpe:2.3:a:oracle:jre:12:::::::*
cpe:2.3:a:oracle:jdk:1.8.0:update201::::::
cpe:2.3:a:oracle:jdk:1.8.0:update202::::::
cpe:2.3:a:oracle:jdk:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.8.0:update201::::::
cpe:2.3:a:oracle:jre:1.7.0:update211::::::
cpe:2.3:a:oracle:jre:1.8.0:update202::::::

Configuration2	or higher	or less	more than	less than
cpe:2.3:o:redhat:enterprise_linux_desktop:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:7.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_desktop:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_server:6.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_workstation:6.0:::::::*
cpe:2.3:a:redhat:satellite:5.8:::::::*
cpe:2.3:a:redhat:openshift_container_platform:3.11:::::::*
cpe:2.3:o:redhat:enterprise_linux:8.0:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.1:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.2:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.4:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_aus:8.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_server_tus:8.6:::::::*
cpe:2.3:o:redhat:enterprise_linux_eus:8.6:::::::*

Configuration5	or higher	or less	more than	less than
cpe:2.3:a:apache:tomcat::::::::	7.0.0	7.0.97
cpe:2.3:a:apache:tomcat::::::::	8.5.0	8.5.47
cpe:2.3:a:apache:tomcat:9.0.0:milestone1::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone10::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone11::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone12::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone13::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone14::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone15::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone16::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone17::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone18::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone19::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone2::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone20::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone21::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone22::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone23::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone24::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone25::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone26::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone27::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone3::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone4::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone5::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone6::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone7::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone8::::::
cpe:2.3:a:apache:tomcat:9.0.0:milestone9::::::
cpe:2.3:a:apache:cassandra:4.0.0:beta1::::::
cpe:2.3:a:apache:cassandra::::::::	3.11.0			3.11.8
cpe:2.3:a:apache:cassandra::::::::	3.0.0			3.0.22
cpe:2.3:a:apache:cassandra::::::::	2.2.0			2.2.18
cpe:2.3:a:apache:cassandra::::::::	2.1.0			2.1.22
cpe:2.3:a:apache:tomcat::::::::	9.0.1	9.0.28