what you don't know can hurt you

Red Hat Security Advisory 2019-0877-01

Red Hat Security Advisory 2019-0877-01
Posted Apr 24, 2019
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2019-0877-01 - Red Hat OpenShift Application Runtimes provides an application platform that reduces the complexity of developing and operating applications for OpenShift as a containerized platform. This release of RHOAR Thorntail 2.4.0 serves as a replacement for RHOAR Thorntail 2.2.0, and includes security and bug fixes and enhancements. For further information, refer to the release notes linked to in the References section. Issues addressed include code execution, denial of service, deserialization, and traversal vulnerabilities.

tags | advisory, denial of service, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2018-1000180, CVE-2018-1067, CVE-2018-10862, CVE-2018-10894, CVE-2018-10912, CVE-2018-1114, CVE-2018-11307, CVE-2018-12022, CVE-2018-12023, CVE-2018-14718, CVE-2018-14719, CVE-2018-19360, CVE-2018-19361, CVE-2018-19362
MD5 | 2146a915fad9f5dc826a08a4e01ddd87

Red Hat Security Advisory 2019-0877-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat OpenShift Application Runtimes Thorntail 2.4.0 security & bug fix update
Advisory ID: RHSA-2019:0877-01
Product: Red Hat OpenShift Application Runtimes
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0877
Issue date: 2019-04-24
CVE Names: CVE-2018-1067 CVE-2018-1114 CVE-2018-10862
CVE-2018-10894 CVE-2018-10912 CVE-2018-11307
CVE-2018-12022 CVE-2018-12023 CVE-2018-14718
CVE-2018-14719 CVE-2018-19360 CVE-2018-19361
CVE-2018-19362 CVE-2018-1000180
====================================================================
1. Summary:

An update is now available for Red Hat OpenShift Application Runtimes.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat OpenShift Application Runtimes provides an application platform
that reduces the complexity of developing and operating applications
(monoliths and microservices) for OpenShift as a containerized platform.

This release of RHOAR Thorntail 2.4.0 serves as a replacement for RHOAR
Thorntail 2.2.0, and includes security and bug fixes and enhancements. For
further information, refer to the release notes linked to in the References
section.

Security Fix(es):

* undertow: HTTP header injection using CRLF with UTF-8 Encoding
(incomplete fix of CVE-2016-4993) (CVE-2018-1067)

* keycloak: auth permitted with expired certs in SAML client
(CVE-2018-10894)

* undertow: File descriptor leak caused by
JarURLConnection.getLastModified() allows attacker to cause a denial of
service (CVE-2018-1114)

* keycloak: infinite loop in session replacement leading to denial of
service (CVE-2018-10912)

* wildfly-core: Path traversal can allow the extraction of .war archives to
write arbitrary files (Zip Slip) (CVE-2018-10862)

* jackson-databind: arbitrary code execution in slf4j-ext class
(CVE-2018-14718)

* jackson-databind: arbitrary code execution in blaze-ds-opt and
blaze-ds-core classes (CVE-2018-14719)

* jackson-databind: improper polymorphic deserialization in
axis2-transport-jms class (CVE-2018-19360)

* jackson-databind: improper polymorphic deserialization in openjpa class
(CVE-2018-19361)

* jackson-databind: improper polymorphic deserialization in
jboss-common-core class (CVE-2018-19362)

* jackson-databind: improper polymorphic deserialization of types from
Oracle JDBC driver (CVE-2018-12023)

* jackson-databind: improper polymorphic deserialization of types from
Jodd-db library (CVE-2018-12022)

* jackson-databind: Potential information exfiltration with default typing,
serialization gadget from MyBatis (CVE-2018-11307)

* bouncycastle: flaw in the low-level interface to RSA key pair generator
(CVE-2018-1000180)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1550671 - CVE-2018-1067 undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)
1573045 - CVE-2018-1114 undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service
1588306 - CVE-2018-1000180 bouncycastle: flaw in the low-level interface to RSA key pair generator
1593527 - CVE-2018-10862 wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)
1599434 - CVE-2018-10894 keycloak: auth permitted with expired certs in SAML client
1607624 - CVE-2018-10912 keycloak: infinite loop in session replacement leading to denial of service
1666415 - CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class
1666418 - CVE-2018-14719 jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes
1666482 - CVE-2018-19360 jackson-databind: improper polymorphic deserialization in axis2-transport-jms class
1666484 - CVE-2018-19361 jackson-databind: improper polymorphic deserialization in openjpa class
1666489 - CVE-2018-19362 jackson-databind: improper polymorphic deserialization in jboss-common-core class
1671096 - CVE-2018-12023 jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver
1671097 - CVE-2018-12022 jackson-databind: improper polymorphic deserialization of types from Jodd-db library
1677341 - CVE-2018-11307 jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis

5. References:

https://access.redhat.com/security/cve/CVE-2018-1067
https://access.redhat.com/security/cve/CVE-2018-1114
https://access.redhat.com/security/cve/CVE-2018-10862
https://access.redhat.com/security/cve/CVE-2018-10894
https://access.redhat.com/security/cve/CVE-2018-10912
https://access.redhat.com/security/cve/CVE-2018-11307
https://access.redhat.com/security/cve/CVE-2018-12022
https://access.redhat.com/security/cve/CVE-2018-12023
https://access.redhat.com/security/cve/CVE-2018-14718
https://access.redhat.com/security/cve/CVE-2018-14719
https://access.redhat.com/security/cve/CVE-2018-19360
https://access.redhat.com/security/cve/CVE-2018-19361
https://access.redhat.com/security/cve/CVE-2018-19362
https://access.redhat.com/security/cve/CVE-2018-1000180
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&productÊtRhoar.thorntail&version=2.4.0
https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html-single/rhoar_thorntail_release_notes/

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXMCvLtzjgjWX9erEAQg89A/7BXw0XUJ42h08r38x4GtqHU40hIoWep2r
ELZUGzzAacSjR4VBEj3xawCdN+pf2EJoiSF/N9S97PtUCcnLWw6bde1cwS5lAQPI
lPnPtLOn0I+QutKAhL8pm6Nz2exZCq2N5WHywmWYrwEMmguh3qe4/RLEYl3F+FBC
7UuztKvvhKOgDebQCGMMbmjZqvimPysyhPwmuQJwVDdbOMQUsWLeKEckCwWvkV93
hNWdNmtmSnMN85DLZVvRs8D7gINGloXqPHBWwRToz/0ORJXIusLIPyfZgTaaFAkz
H1Wu7Tq6pYlMUrSQG6heafaodRfBv93Q1JmdVgVPDQeUB0tYNLHIH/60o8ZlWX67
m+YnB3bDIiEwnwags14BScnwXBxyp0QMRU0xXtJfv5NmZniaUm76KA1oFxKvUVGW
IIyan4gAemvffvOdM3332N00V9xFQwD5ZG60tv4tTCnJbrMWzPmhcO1OFNk/FKQ6
7TEOUvBPcktdz5S+xjGEUkWxm65R4e5QTZsjAAa0bDJPmy2+dNEur9d66YIEwChL
EeCIALrdL7+Sc0omxaDlopxs2ppA+wEamxfwHAkqDoTdqMyZ9fYvZ+SDyiKckAFJ
xvtqSVnLrsKkaZeG7ZZf/o7Qqujbk8LdqbsoAOKs4C+ruW175Wo5AxecigcE8V0F
07jIwvgIuVI=Rx36
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

November 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    2 Files
  • 2
    Nov 2nd
    9 Files
  • 3
    Nov 3rd
    15 Files
  • 4
    Nov 4th
    90 Files
  • 5
    Nov 5th
    22 Files
  • 6
    Nov 6th
    16 Files
  • 7
    Nov 7th
    1 Files
  • 8
    Nov 8th
    1 Files
  • 9
    Nov 9th
    40 Files
  • 10
    Nov 10th
    27 Files
  • 11
    Nov 11th
    28 Files
  • 12
    Nov 12th
    13 Files
  • 13
    Nov 13th
    18 Files
  • 14
    Nov 14th
    2 Files
  • 15
    Nov 15th
    2 Files
  • 16
    Nov 16th
    29 Files
  • 17
    Nov 17th
    15 Files
  • 18
    Nov 18th
    15 Files
  • 19
    Nov 19th
    21 Files
  • 20
    Nov 20th
    16 Files
  • 21
    Nov 21st
    1 Files
  • 22
    Nov 22nd
    0 Files
  • 23
    Nov 23rd
    19 Files
  • 24
    Nov 24th
    0 Files
  • 25
    Nov 25th
    0 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    0 Files
  • 29
    Nov 29th
    0 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close