Twenty Year Anniversary

Red Hat Security Advisory 2018-2909-01

Red Hat Security Advisory 2018-2909-01
Posted Oct 11, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-2909-01 - Red Hat Process Automation Manager is an open source business process management suite that combines process management and decision service management and enables business and IT users to create, manage, validate, and deploy process applications and decision services. This release of Red Hat Process Automation Manager 7.1.0 serves as an update to Red Hat Process Automation Manager 7.0.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Issues addressed include Yaml unmarshalling that is vulnerable to remote code execution.

tags | advisory, remote, code execution
systems | linux, redhat
advisories | CVE-2016-9606
MD5 | 3de3d48898e63d003c45598a07f940b1

Red Hat Security Advisory 2018-2909-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Red Hat Process Automation Manager 7.1.0 bug fix and security update
Advisory ID: RHSA-2018:2909-01
Product: Red Hat Process Automation Manager
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2909
Issue date: 2018-10-11
CVE Names: CVE-2016-9606
=====================================================================

1. Summary:

An update is now available for Red Hat Process Automation Manager.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat Process Automation Manager is an open source business process
management suite that combines process management and decision service
management and enables business and IT users to create, manage, validate,
and deploy process applications and decision services.

This release of Red Hat Process Automation Manager 7.1.0 serves as an
update to Red Hat Process Automation Manager 7.0.2, and includes bug fixes
and enhancements, which are documented in the Release Notes document linked
to in the References.

Security Fix(es):

* Resteasy: Yaml unmarshalling vulnerable to RCE (CVE-2016-9606)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Red Hat would like to thank Moritz Bechler (AgNO3 GmbH & Co. KG) for
reporting CVE-2016-9606.

3. Solution:

For on-premise installations, before applying the update, back up your
existing installation, including all applications, configuration files,
databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application
Server process before installing this update; after installing the update,
restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1400644 - CVE-2016-9606 Resteasy: Yaml unmarshalling vulnerable to RCE

5. References:

https://access.redhat.com/security/cve/CVE-2016-9606
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/documentation/en-us/red_hat_process_automation_manager
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=rhpam&downloadType=distributions

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW79ENtzjgjWX9erEAQhRqQ//fFVUZuCx7Z42ehF4Hzcq83X9gjeebkWz
VK8U5iKDeVNQbyyM81JzaC+L7oL/dcWLj+AwAtEtNnlURwyyCBOD7F6ziA9MnWdd
2lmwfqKrq46HpNX+h/jBY5buQSo4N0F3bXnZ1lJE5sLIch7WBQvo1UN6wNkA+Oez
2PQbbphvkqsivv0EK4WrlW25MO1hvcGwqHZqMvkMGz2pBDRRIxqL1/3DqAzlxLpW
pDxa10Ur2OfsmtjyLojYLs1wiakNo3OyNWzzWhujb6kja/WgNu5wY8QLWg7TiCQq
V9c13gCSP/bmq5G41RPNbr0gdHa13L6FauGenU4WL9NTxFe+2GdEqHvmB1PAx3y9
dOGf5ecv/g3Q62MCJfVhE7mBBtJx/vXH7Gvwid7Q14PIkC2y3XMpdRqqLmNHE+CP
LIWzfDpR/tHqQVlz0Bk3I8akrX3sPYBSbPA2xjz4QeSjqEgCZDUBOE63seOz+/1B
w2hcom5WKuvL5csNom8/vB0QRmNTPrK3KTH+tmVwjd+cE3Dc0AoWNVlZQVfxcwM6
VdptvP6AOAhK5H8z9UQH8goyR89HGNrn4QGMAyDosyKpVQvSyGKMch5YEDAiPDY8
IoCB+4OCELddsSwGmwEzUUyvu79YcSLqMyMJjMrpzGEY8hEz4ikWxVLlSFLhM5IT
Z18xCSqwxs4=
=aeLO
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

December 2018

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Dec 1st
    11 Files
  • 2
    Dec 2nd
    1 Files
  • 3
    Dec 3rd
    18 Files
  • 4
    Dec 4th
    40 Files
  • 5
    Dec 5th
    16 Files
  • 6
    Dec 6th
    50 Files
  • 7
    Dec 7th
    12 Files
  • 8
    Dec 8th
    1 Files
  • 9
    Dec 9th
    1 Files
  • 10
    Dec 10th
    15 Files
  • 11
    Dec 11th
    30 Files
  • 12
    Dec 12th
    25 Files
  • 13
    Dec 13th
    15 Files
  • 14
    Dec 14th
    14 Files
  • 15
    Dec 15th
    0 Files
  • 16
    Dec 16th
    0 Files
  • 17
    Dec 17th
    0 Files
  • 18
    Dec 18th
    0 Files
  • 19
    Dec 19th
    0 Files
  • 20
    Dec 20th
    0 Files
  • 21
    Dec 21st
    0 Files
  • 22
    Dec 22nd
    0 Files
  • 23
    Dec 23rd
    0 Files
  • 24
    Dec 24th
    0 Files
  • 25
    Dec 25th
    0 Files
  • 26
    Dec 26th
    0 Files
  • 27
    Dec 27th
    0 Files
  • 28
    Dec 28th
    0 Files
  • 29
    Dec 29th
    0 Files
  • 30
    Dec 30th
    0 Files
  • 31
    Dec 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2018 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close