CVE Security Fixes for TOS

The tables below include the list of CVEs (Common Vulnerabilities and Exposures) fixed in each release of TOS.

R25-2

Version CVE

PHF4.0.0

PRC1.0.0

 

R25-1

Version CVE

PHF 3.0.0

 

PRC1.0.0

 

R24-2

Version CVE

PGA.0.0

 

PRC1.0.0

R24-1

Version

CVE

PHF4.0.0

 

PHF3.0.0

R23-2

None at this time.

R23-1

Java

Version

CVE

PHF2.0.0

 

PRC1.0.0

  • CVE-2023-21830 - OpenJDK: possible unauthorized update, insert or delete access to accessible data

  • CVE-2023-21843 - OpenJDK: possible unauthorized update, insert or delete access to accessible data

PGA.0.0

R22-2

Java

Version

CVE

PHF2.0.0

 

  • CVE-2023-21830 - OpenJDK: possible unauthorized update, insert or delete access to accessible data

  • CVE-2023-21843 - OpenJDK: possible unauthorized update, insert or delete access to accessible data

PGA.0.0

  • CVE-2022-21619 - OpenJDK: improper handling of long NTLM client hostnames

  • CVE-2022-21624 - OpenJDK: insufficient randomization of JNDI DNS port numbers

  • CVE-2022-21626 - OpenJDK: excessive memory allocation in X.509 certificate parsing

  • CVE-2022-21628 - OpenJDK: HttpServer no connection count limit

  • CVE-2022-21540 - OpenJDK: class compilation issue

  • CVE-2022-21541 - OpenJDK: improper restriction of MethodHandle.invokeBasic()

  • CVE-2022-34169 - OpenJDK: integer truncation issue in Xalan-J

  • CVE-2022-21434 - OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler

  • CVE-2022-21443 - OpenJDK: Missing check for negative ObjectIdentifier

  • CVE-2022-21476 - OpenJDK: Defective secure validation in Apache Santuario

  • CVE-2022-21496 - OpenJDK: URI parsing inconsistencies

  • CVE-2022-21426 - OpenJDK: Unbounded memory allocation when compiling crafted XPath expression

PRC1.0.0

  • CVE-2022-42889 - Apache Commons Text Java Library MOVE TO R23-1 PHF2.0.0 AS PER M.FURMAN DEC 25 2023

R22-1

Java

Version

CVE

PHF4.0.0

 

  • CVE-2022-21619 - OpenJDK: improper handling of long NTLM client hostnames

  • CVE-2022-21624 - OpenJDK: insufficient randomization of JNDI DNS port numbers

  • CVE-2022-21626 - OpenJDK: excessive memory allocation in X.509 certificate parsing

  • CVE-2022-21628 - OpenJDK: HttpServer no connection count limit

  • CVE-2022-21540 - OpenJDK: class compilation issue

  • CVE-2022-21541 - OpenJDK: improper restriction of MethodHandle.invokeBasic()

  • CVE-2022-34169 - OpenJDK: integer truncation issue in Xalan-J

  • CVE-2022-21426 - OpenJDK: Unbounded memory allocation when compiling crafted XPath expressions

  • CVE-2022-21434 - OpenJDK: Improper object-to-string conversion in AnnotationInvocationHandler

  • CVE-2022-21443 - OpenJDK: Missing check for negative ObjectIdentifier

  • CVE-2022-21476 - OpenJDK: Defective secure validation in Apache Santuario

  • CVE-2022-21496 - OpenJDK: URI parsing inconsistencies

PRC1.0.0

  • CVE-2021-35550 - OpenJDK: OpenJDK: Weak ciphers preferred over stronger ones for TLS

  • CVE-2021-35556 - OpenJDK: Excessive memory allocation in RTFParser

  • CVE-2021-35559 - OpenJDK: Excessive memory allocation in RTFReader

  • CVE-2021-35561 - OpenJDK: Excessive memory allocation in HashMap and HashSet

  • CVE-2021-35564 - OpenJDK: Certificates with end dates too far in the future can corrupt keystore

  • CVE-2021-35565 - OpenJDK: Loop in HttpsServer triggered during TLS session close

  • CVE-2021-35567 - OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation

  • CVE-2021-35578 - OpenJDK: Unexpected exception raised during TLS handshake

  • CVE-2021-35586 - OpenJDK: Excessive memory allocation in BMPImageReader

  • CVE-2021-35588 - OpenJDK: Incomplete validation of inner class references in ClassFileParser

  • CVE-2021-35603 - OpenJDK: Non-constant comparison during TLS handshakes

  • CVE-2022-21248 - OpenJDK: Incomplete deserialization class filtering in ObjectInputStream

  • CVE-2022-21282 - OpenJDK: Insufficient URI checks in the XSLT TransformerImpl

  • CVE-2022-21283 - OpenJDK: Unexpected exception thrown in regex Pattern

  • CVE-2022-21293 - OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization

  • CVE-2022-21294 - OpenJDK: Incorrect IdentityHashMap size checks during deserialization

  • CVE-2022-21296 - OpenJDK: Incorrect access checks in XMLEntityManager

  • CVE-2022-21299 - OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner

  • CVE-2022-21305 - OpenJDK: Array indexing issues in LIRGenerator

  • CVE-2022-21340 - OpenJDK: Excessive resource use when reading JAR manifest attributes

  • CVE-2022-21341 - OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream

  • CVE-2022-21360 - OpenJDK: Excessive memory allocation in BMPImageReader

  • CVE-2022-21365 - OpenJDK: Integer overflow in BMPImageReader

R21-3

Java

Version

CVE

PHF2.0.0

 

  • CVE-2022-21248 - OpenJDK: Incomplete deserialization class filtering in ObjectInputStream

  • CVE-2022-21282 - OpenJDK: Insufficient URI checks in the XSLT TransformerImpl

  • CVE-2022-21283 - OpenJDK: Unexpected exception thrown in regex Pattern

  • CVE-2022-21293 - OpenJDK: Incomplete checks of StringBuffer and StringBuilder during deserialization

  • CVE-2022-21294 - OpenJDK: Incorrect IdentityHashMap size checks during deserialization

  • CVE-2022-21296 - OpenJDK: Incorrect access checks in XMLEntityManager

  • CVE-2022-21299 - OpenJDK: Infinite loop related to incorrect handling of newlines in XMLEntityScanner

  • CVE-2022-21305 - OpenJDK: Array indexing issues in LIRGenerator

  • CVE-2022-21340 - OpenJDK: Excessive resource use when reading JAR manifest attributes

  • CVE-2022-21341 - OpenJDK: Insufficient checks when deserializing exceptions in ObjectInputStream

  • CVE-2022-21360 - OpenJDK: Excessive memory allocation in BMPImageReader

  • CVE-2022-21365 - OpenJDK: Integer overflow in BMPImageReader

PGA.0.0

  • CVE-2021-35550 - OpenJDK: OpenJDK: Weak ciphers preferred over stronger ones for TLS

  • CVE-2021-35556 - OpenJDK: Excessive memory allocation in RTFParser

  • CVE-2021-35559 - OpenJDK: Excessive memory allocation in RTFReader

  • CVE-2021-35561 - OpenJDK: Excessive memory allocation in HashMap and HashSet

  • CVE-2021-35564 - OpenJDK: Certificates with end dates too far in the future can corrupt keystore

  • CVE-2021-35565 - OpenJDK: Loop in HttpsServer triggered during TLS session close

  • CVE-2021-35567 - OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation

  • CVE-2021-35578 - OpenJDK: Unexpected exception raised during TLS handshake

  • CVE-2021-35586 - OpenJDK: Excessive memory allocation in BMPImageReader

  • CVE-2021-35588 - OpenJDK: Incomplete validation of inner class references in ClassFileParser

  • CVE-2021-35603 - OpenJDK: Non-constant comparison during TLS handshakes

  • CVE-2021-2388 - OpenJDK: Incorrect comparison during range check elimination

PRC1.0.0

  • CVE-2021-2369 - OpenJDK: Incorrect verification of JAR files with multiple MANIFEST.MF files

  • CVE-2021-2341 - OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host

  • CVE-2021-2163 - OpenJDK: Incomplete enforcement of JAR signing disabled algorithms

R21-2

Java

Version

CVE

PHF2

 

  • CVE-2021-35550 - OpenJDK: OpenJDK: Weak ciphers preferred over stronger ones for TLS

  • CVE-2021-35556 - OpenJDK: Excessive memory allocation in RTFParser

  • CVE-2021-35559 - OpenJDK: Excessive memory allocation in RTFReader

  • CVE-2021-35561 - OpenJDK: Excessive memory allocation in HashMap and HashSet

  • CVE-2021-35564 - OpenJDK: Certificates with end dates too far in the future can corrupt keystore

  • CVE-2021-35565 - OpenJDK: Loop in HttpsServer triggered during TLS session close

  • CVE-2021-35567 - OpenJDK: Incorrect principal selection when using Kerberos Constrained Delegation

  • CVE-2021-35578 - OpenJDK: Unexpected exception raised during TLS handshake

  • CVE-2021-35586 - OpenJDK: Excessive memory allocation in BMPImageReader

  • CVE-2021-35588 - OpenJDK: Incomplete validation of inner class references in ClassFileParser

  • CVE-2021-35603 - OpenJDK: Non-constant comparison during TLS handshakes

PHF1

  • CVE-2021-2388 - OpenJDK: Incorrect comparison during range check elimination

  • CVE-2021-2369 - OpenJDK: Incorrect verification of JAR files with multiple MANIFEST.MF files

  • CVE-2021-2341 - OpenJDK: FTP PASV command response can cause FtpClient to connect to arbitrary host

PGA

  • CVE-2021-2163 - OpenJDK: Incomplete enforcement of JAR signing disabled algorithms

jQuery

Version

CVE

PGA

 

  • CVE-2020-11023 - In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

  • CVE-2020-11022In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

  • CVE-2019-11358jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.

R21-1

Java

Version

CVE

PRC1

 

  • CVE-2020-14556 - OpenJDK: Incorrect handling of access control context in ForkJoinPool

  • CVE-2020-14577 - OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form

  • CVE-2020-14578 - OpenJDK: Unexpected exception raised by DerInputStream

  • CVE-2020-14579 - OpenJDK: Unexpected exception raised by DerValue.equals()

  • CVE-2020-14583 - OpenJDK: Bypass of boundary checks in nio.Buffer via concurrent access

  • CVE-2020-14593 - OpenJDK: Incomplete bounds checks in Affine Transformations

  • CVE-2020-14621 - OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature

R20-2

Tufin SecureTrack

Version

CVE

GA

 

Tufin SecureChange

Version

CVE

GA

 

Java

Version

CVE

GA

 

  • CVE-2020-14556 - OpenJDK: Incorrect handling of access control context in ForkJoinPool

  • CVE-2020-14577 - OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form

  • CVE-2020-14578 - OpenJDK: Unexpected exception raised by DerInputStream

  • CVE-2020-14579 - OpenJDK: Unexpected exception raised by DerValue.equals()

  • CVE-2020-14583 - OpenJDK: Bypass of boundary checks in nio.Buffer via concurrent access

  • CVE-2020-14593 - OpenJDK: Incomplete bounds checks in Affine Transformations

  • CVE-2020-14621 - OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature

RC1

  • CVE-2020-2754 - OpenJDK: Misplaced regular expression syntax error check in RegExpScanne

  • CVE-2020-2755 - OpenJDK: Incorrect handling of empty string nodes in regular expression Parser

  • CVE-2020-2756 - OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization

  • CVE-2020-2757 - OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass

  • CVE-2020-2773 - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory

  • CVE-2020-2781 - OpenJDK: Re-use of single TLS session for new connections

  • CVE-2020-2800 - OpenJDK: CRLF injection into HTTP headers in HttpServer

  • CVE-2020-2803 - OpenJDK: Incorrect bounds checks in NIO Buffers

  • CVE-2020-2805 - OpenJDK: Incorrect type checks in MethodType.readObject()

  • CVE-2020-2830 - OpenJDK: Regular expression DoS in Scanner

R20-1

Tufin SecureTrack

Version

CVE

HF3

 

  • CVE-2020-13133 - Low Severity Cross-Site Scripting (XSS) Vulnerabilities in SecureChange

  • CVE-2020-13134 - Low Severity Cross-Site Scripting (XSS) Vulnerabilities in SecureChange

Java

Version

CVE

HF3

 

  • CVE-2020-14577 - OpenJDK: HostnameChecker does not ensure X.509 certificate names are in normalized form

  • CVE-2020-14578 - OpenJDK: Unexpected exception raised by DerInputStream

  • CVE-2020-14579 - OpenJDK: Unexpected exception raised by DerValue.equals()

  • CVE-2020-14583 - OpenJDK: Bypass of boundary checks in nio.Buffer via concurrent access

  • CVE-2020-14593 - OpenJDK: Incomplete bounds checks in Affine Transformations

  • CVE-2020-14621 - OpenJDK: XML validation manipulation due to incomplete application of the use-grammar-pool-only feature

  • CVE-2020-14556 - OpenJDK: Incorrect handling of access control context in ForkJoinPool

HF1

  • CVE-2020-2754 - OpenJDK: Misplaced regular expression syntax error check in RegExpScanne

  • CVE-2020-2755 - OpenJDK: Incorrect handling of empty string nodes in regular expression Parser

  • CVE-2020-2756 - OpenJDK: Incorrect handling of references to uninitialized class descriptors during deserialization

  • CVE-2020-2757 - OpenJDK: Uncaught InstantiationError exception in ObjectStreamClass

  • CVE-2020-2773 - OpenJDK: Unexpected exceptions raised by DOMKeyInfoFactory and DOMXMLSignatureFactory

  • CVE-2020-2781 - OpenJDK: Re-use of single TLS session for new connections

  • CVE-2020-2800 - OpenJDK: CRLF injection into HTTP headers in HttpServer

  • CVE-2020-2803 - OpenJDK: Incorrect bounds checks in NIO Buffers

  • CVE-2020-2805 - OpenJDK: Incorrect type checks in MethodType.readObject()

  • CVE-2020-2830 - OpenJDK: Regular expression DoS in Scanner

RC1

  • CVE-2020-2583 - OpenJDK: Incorrect exception processing during deserialization in BeanContextSupport

  • CVE-2020-2590 - OpenJDK: Improper checks of SASL message properties in GssKrb5Base

  • CVE-2020-2593 - OpenJDK: Incorrect isBuiltinStreamHandler check causing URL normalization issues

  • CVE-2020-2601- OpenJDK: Use of unsafe RSA-MD5 checksum in Kerberos TGS

  • CVE-2020-2604- OpenJDK: Serialization filter changes via jdk.serialFilter property modification

  • CVE-2020-2654- OpenJDK: Excessive memory usage in OID processing in X.509 certificate parsing

  • CVE-2020-2659- OpenJDK: Incomplete enforcement of maxDatagramSockets limit in DatagramChannelImpl