Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:rpm/redhat/eap7-jboss-marshalling@2.0.7-2.Final_redhat_00001.1?arch=el6eap
purl pkg:rpm/redhat/eap7-jboss-marshalling@2.0.7-2.Final_redhat_00001.1?arch=el6eap
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 4.5
Vulnerabilities affecting this package (3)
Vulnerability Summary Fixed by
VCID-5jyy-ep7a-kqek
Aliases:
CVE-2019-3873
picketlink: URL injection via xinclude parameter There are no reported fixed by versions.
VCID-bhrz-ea7j-k3bh
Aliases:
CVE-2019-3888
GHSA-jwgx-9mmh-684w
Information Exposure An information exposure of plain text credentials through log files because `Connectors.executeRootHandler:402` logs the `HttpServerExchange` object at `ERROR` level using `UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t,exchange)`. There are no reported fixed by versions.
VCID-ybwn-kuz6-bkds
Aliases:
CVE-2019-3872
picketlink: reflected XSS in SAMLRequest via RelayState parameter There are no reported fixed by versions.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-01T14:18:56.264574+00:00 RedHat Importer Affected by VCID-bhrz-ea7j-k3bh https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3888.json 38.0.0
2026-04-01T14:18:54.487293+00:00 RedHat Importer Affected by VCID-5jyy-ep7a-kqek https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3873.json 38.0.0
2026-04-01T14:18:52.998242+00:00 RedHat Importer Affected by VCID-ybwn-kuz6-bkds https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-3872.json 38.0.0