[security - high] pki-deps:10.6 security update, xsom-0-19.20110809svn.module+el8+2015+b4b2375a

エラータID: AXSA:2026-1419:01

Release date: 
Monday, August 3, 2026 - 20:30
Subject: 
[security - high] pki-deps:10.6 security update, xsom-0-19.20110809svn.module+el8+2015+b4b2375a
Affected Channels: 
Asianux Server 8 for x86_64
Severity: 
High
Description: 

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Asianux Certificate System.

Security Fix(es):

* jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution (CVE-2026-54513)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-54513
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.

Modularity name: "pki-deps"
Stream name: "10.6"

Solution: 

Update packages.

CVEs: 
CVE-2026-54513
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.10.0 until 2.18.8, 2.21.4, and 3.1.4, BasicPolymorphicTypeValidator.Builder.allowIfSubTypeIsArray() allowlists any array type based only on clazz.isArray(), without validating the array's component (element) type against the configured allowlist. A PTV built with allowIfSubTypeIsArray() plus an explicit concrete-type allowlist therefore still permits EvilType[] even though EvilType is not allowlisted. When Jackson deserializes the elements and no per-element type IDs are present, it instantiates the component type directly with no further PTV check, bypassing the allowlist. This vulnerability is fixed in 2.18.8, 2.21.4, and 3.1.4.
Additional Info: 

N/A

Download: 

SRPMS
  1. apache-commons-collections-3.2.2-10.module+el8+2015+b4b2375a.src.rpm
    MD5: 556c02ac2f59924d65de1d618d497b68
    SHA-256: 55392d1659cb80acfbddb4833ab91ec237de70f5780403fe32ff13986af93a84
    Size: 631.54 kB
  2. apache-commons-lang-2.6-21.module+el8+2015+b4b2375a.src.rpm
    MD5: 774ed4709b750a2c69301299eaea1bae
    SHA-256: ba76a6f89dcd7622a9f6b1ec322420e50bc628b13d9ffa093cf93a68d41f5aa4
    Size: 564.15 kB
  3. apache-commons-net-3.6-3.module+el8+2015+b4b2375a.src.rpm
    MD5: c08d4179d50bf981a07c7517b096e6df
    SHA-256: ddbac3decdf4ffb3e20f36ed4dd22f6f6bb5d752d42354168c8899543bdd6420
    Size: 433.46 kB
  4. bea-stax-1.2.0-16.module+el8+2015+b4b2375a.src.rpm
    MD5: f55ac3a3fec55cbfc9a099cfb5ba61ca
    SHA-256: 2e861ef8747226f772f93c3f06c6c45aa625e2e500bc8488d9e8ef21e41df909
    Size: 295.00 kB
  5. fasterxml-oss-parent-75-1.module+el8+2015+b4b2375a.src.rpm
    MD5: 260f0b449f38aca1353481c0dd352ef5
    SHA-256: 5c1e498517550864040a462b8a64f2d48686b98e33f6137f2a19ce30e28ef378
    Size: 29.63 kB
  6. glassfish-fastinfoset-1.2.13-9.module+el8+2015+b4b2375a.src.rpm
    MD5: 926e8c042e25786d1dc9c7a4ff475b03
    SHA-256: d230ba0ee5e3a0f2443ff4ce87cc1f9d73365deb45fe204df47333aaab9cf989
    Size: 1.52 MB
  7. glassfish-jaxb-api-2.2.12-8.module+el8+2015+b4b2375a.src.rpm
    MD5: 8364000d0e8b71b3932a9b333b18c207
    SHA-256: 99814a61fbcb488dad141940000302a774b76b0b2d52c826881d3ef36683cae5
    Size: 241.88 kB
  8. glassfish-jaxb-2.2.11-12.module+el8+2015+b4b2375a.src.rpm
    MD5: 1ddd6c0e8db1fd3e9621bef8cce4efcf
    SHA-256: 772d6edba546776d19855f0bd2d9679dd5c97aa665b0c45f05cdd48facdbeb73
    Size: 4.40 MB
  9. glassfish-jax-rs-api-2.0.1-6.module+el8+2015+b4b2375a.src.rpm
    MD5: 62f044bc6d16d2c5d69b87d5021ace0d
    SHA-256: 80c9eabccfd135ccf3cb15ca18a91a7879e3a6750345c35bd94f592927a48a1f
    Size: 230.19 kB
  10. jackson-annotations-2.21-1.module+el8+2015+b4b2375a.src.rpm
    MD5: eb05fb55100160faf579d39d68ab8e10
    SHA-256: e7fdba1bcab86d000004fbd8f3c86ac5333d06dc34166694881edd377f393719
    Size: 96.75 kB
  11. jackson-bom-2.21.4-1.module+el8+2015+b4b2375a.src.rpm
    MD5: b8b67cd7e37a4d4891669efcad81bb31
    SHA-256: e5c9584784d2d749446c0355a288e79de9001ae0dc9b7bdfa83cf3503dbbdb79
    Size: 78.79 kB
  12. jackson-core-2.21.4-1.module+el8+2015+b4b2375a.src.rpm
    MD5: 869d96f4e578c18508a5cc73894f7fe2
    SHA-256: e0a7d955e8463c5de3a36d8218840b2ad0d2fc8aa2127df81e9cbf6d19f69ad9
    Size: 1.20 MB
  13. jackson-databind-2.21.4-1.module+el8+2015+b4b2375a.src.rpm
    MD5: ef922c37e897af1f35a91f973841a335
    SHA-256: 2e867c4b7193c298fb13ad42a82e95988fcd1c346a59c07eed6195659cb3a327
    Size: 1.71 MB
  14. jackson-jaxrs-providers-2.21.4-1.module+el8+2015+b4b2375a.src.rpm
    MD5: fa360ca84e2f85ae078f4258c9acd5b9
    SHA-256: 2e1f71af4adb5f7dcf5004cde5f09df79a1a5cdd334224283a753c105e88cb43
    Size: 1.87 MB
  15. jackson-modules-base-2.21.4-2.module+el8+2015+b4b2375a.src.rpm
    MD5: bcc1f0a44086e8d04bc70e1fe3d07bcb
    SHA-256: a6ef3d88a814c382fc51bf1e64a66a369d753bc31a437b3d192b6e5aa9575ee2
    Size: 2.26 MB
  16. jackson-parent-2.21-1.module+el8+2015+b4b2375a.src.rpm
    MD5: 9950aa4d687ce55bbb17beaac9739861
    SHA-256: 747f7897e59d2c9f0cb371dd59ae0aa496dbfc2355c7a02b8049f39deb7a332e
    Size: 68.44 kB
  17. jakarta-commons-httpclient-3.1-28.module+el8+2015+b4b2375a.src.rpm
    MD5: 98c62794581af2bb34338dafc2d1776e
    SHA-256: 6dffa54feb06f2f919a317bfd6504ed1179d9f8fe731b18df631aaf3f4ecb054
    Size: 1.81 MB
  18. javassist-3.18.1-8.module+el8+2015+b4b2375a.src.rpm
    MD5: 367f510578ddaf7f90902cc668de2b96
    SHA-256: d081cb6660f058264b2111d4ef7f031ac6b143ed5014ab2bd85c18140f3e98ef
    Size: 1.13 MB
  19. msv-2013.6.1-10.module+el8+2015+b4b2375a.src.rpm
    MD5: 7d6be900b543491450fe0332fc6b1b3f
    SHA-256: f2cd41412148fcae6863a8ed25262e9ad22f11e347288ed4b9fdb89b747378f9
    Size: 768.27 kB
  20. pki-servlet-engine-9.0.62-1.module+el8+2015+b4b2375a.src.rpm
    MD5: b17400fc37154489da9b3925f4884c24
    SHA-256: 8ec58f935354b70c23ce35bf5e50297b661325135870b25d4526887f69a7ce28
    Size: 9.82 kB
  21. relaxngcc-1.12-14.module+el8+2015+b4b2375a.src.rpm
    MD5: 7e7541c1d7bd0c5da618835427b1a172
    SHA-256: 08af1c8ffa5c00bd905b2972950029d31e229ac581e5836e4cd329a84e2d3329
    Size: 2.03 MB
  22. relaxngDatatype-2011.1-7.module+el8+2015+b4b2375a.src.rpm
    MD5: 2fed32d88e7cc0715dc597b694d94863
    SHA-256: f551f7810170280d4e377c47771b75796e68bf5976b71c6bf17bc7ab1400bffd
    Size: 22.17 kB
  23. slf4j-1.7.25-4.module+el8+2015+b4b2375a.src.rpm
    MD5: e6e56416e4e406360d2b0511d0ac500e
    SHA-256: 4b4ab4bf7be5e7ed9b5952ee52feca8f08fba15eb63af27d305bdc2097da4d24
    Size: 3.29 MB
  24. stax-ex-1.7.7-8.module+el8+2015+b4b2375a.src.rpm
    MD5: 67d555e78de366be6d32c2ea487c0720
    SHA-256: 9c866a9a55ba11a95fba90bbda47b11366551c3d97530f93534e0f54623805a7
    Size: 49.04 kB
  25. velocity-1.7-24.module+el8+2015+b4b2375a.src.rpm
    MD5: ff63c641879011ce6ef6068a2061c9ef
    SHA-256: 89bac6bf82ee023caad458bb1c4dfa94a6ee6085ecc407197d36257370a4de80
    Size: 1.51 MB
  26. xalan-j2-2.7.1-38.module+el8+2015+b4b2375a.src.rpm
    MD5: 1fc6e4f4ad66becfde272f6b44b0d98c
    SHA-256: 3f6d2588cf5fbd4ee3e6fc69cc0d1f27a572b10d3c79b827f1b3da9f122c58db
    Size: 3.24 MB
  27. xerces-j2-2.11.0-34.module+el8+2015+b4b2375a.src.rpm
    MD5: 1576344d43c6bfa320513d3c1bfec1b5
    SHA-256: b3be735e3a3ce8f852e62eba9c847b8a76fb6f318a83024d6a7b5bda54209f93
    Size: 1.74 MB
  28. xml-commons-apis-1.4.01-25.module+el8+2015+b4b2375a.src.rpm
    MD5: 08ac7b591d5ba1e6224617ac67c6b2f5
    SHA-256: b2de1b13ea9475ec7f81fbd395e4c4f34c570a011188fa7a1c9aa7825d0ad130
    Size: 941.07 kB
  29. xml-commons-resolver-1.2-26.module+el8+2015+b4b2375a.src.rpm
    MD5: 1b26d828d28cc02b075f69dfad1d8af2
    SHA-256: bf3a00f0b0d80d639f3a9700d5e144361a7f135d0b59025d46d86b24105ceae7
    Size: 273.42 kB
  30. xmlstreambuffer-1.5.4-8.module+el8+2015+b4b2375a.src.rpm
    MD5: b80820b181f2f871e13f63b9c6f10e07
    SHA-256: 80a0fb18d5f83225029b5b196febd4dd4549955398b0dcff4c68beeed31768db
    Size: 64.55 kB
  31. xml-stylebook-1.0-0.25.b3_xalan2.svn313293.module+el8+2015+b4b2375a.src.rpm
    MD5: c3e882b0c6e811ecd2dbcdba600fb8b5
    SHA-256: f66448593d6a861c34c786bcdc9586e674401f40f596435b2ab5eb46e8b75d24
    Size: 1.13 MB
  32. xsom-0-19.20110809svn.module+el8+2015+b4b2375a.src.rpm
    MD5: 9bc50f7c0e1d0495945880ca7cf18371
    SHA-256: 2078c1ff745418b0aa4c8a7177017dc6460bdd81c518cf5e1eb786f3e221fefa
    Size: 387.95 kB

Asianux Server 8 for x86_64
  1. apache-commons-collections-3.2.2-10.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 219a4ff0463b6d7ac3b6eb982c239074
    SHA-256: 3392d643bea9ec86275f5f5467e434fbfa9713141c1319623f27f400f3a8cb4f
    Size: 535.59 kB
  2. apache-commons-lang-2.6-21.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 81f71986d69d7aef9410c1aea0b30d35
    SHA-256: 34b3b5538f276293fb7aff9bea39169a44e63c0adcd211883fb52f8ec09bdf27
    Size: 281.37 kB
  3. apache-commons-net-3.6-3.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 37e87679d5e58843d941d40007b8ab4c
    SHA-256: 0819b792b235b2ba9241f698558d150d79c3088cc9810c32f318cc453f36200d
    Size: 295.60 kB
  4. bea-stax-1.2.0-16.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 1296e5ebf890756315054b111764055a
    SHA-256: e7991827fc844266e1f62ba32a7617b4ec385e2ffeb0b977e776c78983af5f0d
    Size: 182.12 kB
  5. bea-stax-api-1.2.0-16.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 5c9847bcfde3846b1f765567c07b21c1
    SHA-256: b743132592687b856648579d60b99bb28dd4bdef1f7d7fc4354f28df22bdb5c9
    Size: 35.55 kB
  6. glassfish-fastinfoset-1.2.13-9.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 3698bc5ba625d8e262af326ab9b7e937
    SHA-256: 86dd04a5a8fcef029a4c23bbbaed107804e9c489f8c292f3a2f6db4068934519
    Size: 352.65 kB
  7. glassfish-jaxb-2.2.11-12.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 17c9ea983deacfdc0314c0d697ca7fce
    SHA-256: bd781507fe9d330a9bf2df0377421b75c171833df5b3d8ae8d97c2dcbdd4c1f6
    Size: 27.22 kB
  8. glassfish-jaxb-api-2.2.12-8.module+el8+2015+b4b2375a.noarch.rpm
    MD5: c87cb5834e58d611e527ad52ed4ff903
    SHA-256: 7d4d20e17fe9b61324a09df575916d706487d1929289ae243c7b77a626539e69
    Size: 100.27 kB
  9. glassfish-jaxb-core-2.2.11-12.module+el8+2015+b4b2375a.noarch.rpm
    MD5: cb945c551243a497b0b2646dda9dcc65
    SHA-256: 2e030dc347f8635cd4bf9d6b35d203e7dfe865ecb055a217acc4cd2cf906e28a
    Size: 156.97 kB
  10. glassfish-jaxb-runtime-2.2.11-12.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 9af84fa2d897f33f6b5f937e65b73c80
    SHA-256: 7cb6d20a8d5dce673de211a9db6d2a74bcbdcda18ce4c4974855862e1a075dc9
    Size: 935.91 kB
  11. glassfish-jaxb-txw2-2.2.11-12.module+el8+2015+b4b2375a.noarch.rpm
    MD5: d032539a9732d3fc3007caac7865e62a
    SHA-256: e74f9b4f20e0c46348e01ca4a62d6c8cd4df81b6cc1e53fbba54ad8a1d6ba95d
    Size: 89.14 kB
  12. jackson-annotations-2.21-1.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 7c7bda0be0260ab723cd5b5c2e8f297e
    SHA-256: e2b05ecf505b96b05e36b243dd86da70719e043c84a3e5794e4f7e9ee5f72927
    Size: 85.87 kB
  13. jackson-core-2.21.4-1.module+el8+2015+b4b2375a.noarch.rpm
    MD5: cb504673e241d3ff93d6735853742018
    SHA-256: 954d591e8c39539ec373b8444e55f3eeb96fe9cbd7b0044564577486c3685af9
    Size: 468.17 kB
  14. jackson-databind-2.21.4-1.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 6558b4d4ca22e0778c3e0ed22173977a
    SHA-256: dd0bce6b77cd2bec73c787d255b3bd3c7e71e19996c028e9869dbb8be711b70c
    Size: 1.57 MB
  15. jackson-jaxrs-json-provider-2.21.4-1.module+el8+2015+b4b2375a.noarch.rpm
    MD5: c88fd5fe42293b83690fec2c9aef6861
    SHA-256: 47f5402c8498aacf2f28265c5c8c03894807ca9e425cd9a6493812a41799a68c
    Size: 23.44 kB
  16. jackson-jaxrs-providers-2.21.4-1.module+el8+2015+b4b2375a.noarch.rpm
    MD5: dc5dbff013d058ad0b2c3383365e2ef9
    SHA-256: edd88c15346f5f7222fa8af4e804f3472f0595f6e54b46a90c53ba59d3fabad0
    Size: 49.84 kB
  17. jackson-module-jaxb-annotations-2.21.4-2.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 93ea09fc82dbeae21c5e34cc91a050bf
    SHA-256: e662523a5458928dfe19f1f4c6137b3f9d0201a847c64180b2ad7415a7f735dc
    Size: 50.87 kB
  18. jackson-modules-base-2.21.4-2.module+el8+2015+b4b2375a.noarch.rpm
    MD5: b4c16530728882163fc7aa854e33995d
    SHA-256: 603f209af34a089faa0df83aa491928d86eda46d48c349b386fd0b893efce638
    Size: 21.90 kB
  19. jakarta-commons-httpclient-3.1-28.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 6c06869fc61c5e76f37a8f78b960464e
    SHA-256: a7f8d3f89f875bbd16c7fa24e0e7a33b61ce7df92066f852fee7fad481cff131
    Size: 246.49 kB
  20. javassist-3.18.1-8.module+el8+2015+b4b2375a.noarch.rpm
    MD5: efc422b04f9c9aea94e18bd7b70f2a79
    SHA-256: bfa734f92fe0048c7580b3dd64a8103ac717a306d0ca8d984d652102247cbef1
    Size: 680.82 kB
  21. javassist-javadoc-3.18.1-8.module+el8+2015+b4b2375a.noarch.rpm
    MD5: b9004b1b26f7d7798c66fdf7b3e3022b
    SHA-256: cd92e30261af988a2d5f31c76fc521246f614e1b6e68acb71391d59da24ac2bc
    Size: 780.87 kB
  22. pki-servlet-engine-9.0.62-1.module+el8+2015+b4b2375a.noarch.rpm
    MD5: daa768a9cb9d19330bc78841be60730a
    SHA-256: 3d33f503173ed796ed2fa84a30f99698c681b6c2a7457bb2f954392deac81ee9
    Size: 8.33 kB
  23. relaxngDatatype-2011.1-7.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 3af52c2c06f82dfe71d0cc9c5ecd4d57
    SHA-256: 1c3844f2d62fc63d528f4b1155180030154f7c0ab0221a2acd300abc3d81554f
    Size: 26.26 kB
  24. slf4j-1.7.25-4.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 56702f989c2c4f63931a65e72acc5136
    SHA-256: 92d34c8ec06246ed38cd423a75481ac750177b28221038a3aa1fdf50cfeb455f
    Size: 75.56 kB
  25. slf4j-jdk14-1.7.25-4.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 4027a008cfce419f504c66e2821da4f4
    SHA-256: 6a717fcf8ccea59ab1a641eb95abec17fdee1d7171ef6815d462485bbea7acc2
    Size: 23.61 kB
  26. stax-ex-1.7.7-8.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 47149adbd71e811a9e4091933b1f6238
    SHA-256: 79678ded6518ace4fc730ced4fde7239051b3f5adcc5ce9e54dcd5e6af5636cf
    Size: 54.33 kB
  27. velocity-1.7-24.module+el8+2015+b4b2375a.noarch.rpm
    MD5: b41026900a22502f08126ccee1f46374
    SHA-256: 1aecf8c609dc962f5845f5a7f74c5d60d97278b86ceb62591ba809f4660ff958
    Size: 435.38 kB
  28. xalan-j2-2.7.1-38.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 6a8e52ebaf027529fa5f10f89d57e270
    SHA-256: 5b60818c2370e474ff32cfbdccd4463931f7d36384806732d4ceb623c1fd6677
    Size: 1.89 MB
  29. xerces-j2-2.11.0-34.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 25c20deb2ac8ff72baed21afc354ca2c
    SHA-256: b7313f8246a43095e46a71e2b6f219a7d9b6508eccbbdc7c0ac2e64b7fcc3a23
    Size: 1.16 MB
  30. xml-commons-apis-1.4.01-25.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 2326644ac5d48332ef1646b3738b8893
    SHA-256: 10b0608de8d1e2cd0ff111f78fd152982c4514f45dfc4fe706e3b09f12f1ca5d
    Size: 233.02 kB
  31. xml-commons-resolver-1.2-26.module+el8+2015+b4b2375a.noarch.rpm
    MD5: 8dfd69ea3dba9e2509f8bba679ae5862
    SHA-256: b17fd24774c5ad541bf029ee8629d06967002726a10268e8db9756718b0d65e9
    Size: 114.24 kB
  32. xmlstreambuffer-1.5.4-8.module+el8+2015+b4b2375a.noarch.rpm
    MD5: d7deaf94bb67e1ef49a18ee89186a1cd
    SHA-256: 87be214452199d37e9a368144f79ffcac14051844dc6fd9cf36328f5dd49384d
    Size: 85.94 kB
  33. xsom-0-19.20110809svn.module+el8+2015+b4b2375a.noarch.rpm
    MD5: bd3c2bc70d2f889d93ad1f2eb7c164a1
    SHA-256: 9dc6b0213794fda076b9c0131a9a3a07314bda6087044ed27066e103da11f66e
    Size: 397.39 kB