what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Red Hat Security Advisory 2018-2938-01

Red Hat Security Advisory 2018-2938-01
Posted Oct 17, 2018
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2018-2938-01 - Red Hat OpenShift Application Runtimes provides an application platform that reduces the complexity of developing and operating applications for OpenShift as a containerized platform. This release of RHOAR Thorntail 2.2.0 serves as a replacement for RHOAR WildFly Swarm 7.1.0, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include a traversal vulnerability.

tags | advisory
systems | linux, redhat
advisories | CVE-2018-1047, CVE-2018-7489
SHA-256 | c4ab1f675076791f9f8924f862c33bff93183dc8b2b2b92ae0f236fc39bfdd09

Red Hat Security Advisory 2018-2938-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Moderate: Red Hat OpenShift Application Runtimes Thorntail 2.2.0 security & bug fix update
Advisory ID: RHSA-2018:2938-01
Product: Red Hat OpenShift Application Runtimes
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2938
Issue date: 2018-10-17
CVE Names: CVE-2018-1047 CVE-2018-7489
====================================================================
1. Summary:

An update is now available for Red Hat OpenShift Application Runtimes.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Application Runtimes provides an application platform
that reduces the complexity of developing and operating applications
(monoliths and microservices) for OpenShift as a containerized platform.

This release of RHOAR Thorntail 2.2.0 serves as a replacement for RHOAR
WildFly Swarm 7.1.0, and includes security and bug fixes and enhancements.
For further information, refer to the release notes linked to in the
References section.

Security Fix(es):

* undertow: Path traversal in ServletResourceManager class (CVE-2018-1047)

* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe
serialization via c3p0 libraries (CVE-2018-7489)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1528361 - CVE-2018-1047 undertow: Path traversal in ServletResourceManager class
1549276 - CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries

5. References:

https://access.redhat.com/security/cve/CVE-2018-1047
https://access.redhat.com/security/cve/CVE-2018-7489
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&productEtRhoar.wildFly.swarm&version=2.2.0
https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html-single/red_hat_openshift_application_runtimes_release_notes/

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW8czrtzjgjWX9erEAQgCNw/9EbNNow/AzpCR+b2hL8LzCpu0dio6neYI
tmVv5ITJS+lA/bA55tRRRr4T+AD4lwHoUrrdN8gRNbu81T/RMZfjupkQHunO1bYj
5n4e/0mGsxNEBlIR4XeLmdFVJfdaqfzz0IiBhvXME9UcSjJQxQlLYIK0sXceFaWp
HATkczYlzh2b0J3cgSDnaDrcW4hbX17gsTLbIkb+qoct/ZJOQINgg1I1lpSveejj
uSWxQuwGhlm/ciNDkmJAFPU/DjthkoXiKrLKWpca1YmBoNgL1hVxgyR7apiPW5wy
PxgqkDnjmZ6XSCBZyL6n6WU9YTiBHgZpJ8SbJx7WjtCoGZbyUJPSR8T2fhi+0sS2
u+Aezzi1G8iyIhaVtVWAfsVORuIlgngntT7tH7PoZtE9MI8dAa6IDEEaBeBzbFP0
x5v+Ds9vPQo4KPe95hmHsCgyNt+moPnI2tICKHL4ppSiLp4UPCHyRH8xhTvIU/Bx
kUdGTjMHK+Xr/pkSmo4qfZ2pVPf7n871MzlR75diCTQ6kJ8aoFcRtrLARw16sNsa
cYIIQdWHfB6a/GFuqjSiuO/ev4pHQY6EOQiLZYyqpQ5YKn+aOzxp7DYm6x0m5xsM
V5TYHi6CgwzEJWztnR5DU/cgAwVAe/qUD8Qyj3GymXFXs1e7UM9szNgSsul0zCHp
eM1VeQQvvOo=x5e8
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

June 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    19 Files
  • 2
    Jun 2nd
    16 Files
  • 3
    Jun 3rd
    28 Files
  • 4
    Jun 4th
    0 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    19 Files
  • 7
    Jun 7th
    23 Files
  • 8
    Jun 8th
    11 Files
  • 9
    Jun 9th
    10 Files
  • 10
    Jun 10th
    4 Files
  • 11
    Jun 11th
    0 Files
  • 12
    Jun 12th
    0 Files
  • 13
    Jun 13th
    0 Files
  • 14
    Jun 14th
    0 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    27 Files
  • 20
    Jun 20th
    65 Files
  • 21
    Jun 21st
    10 Files
  • 22
    Jun 22nd
    8 Files
  • 23
    Jun 23rd
    6 Files
  • 24
    Jun 24th
    6 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close