-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Fuse 7.3 security update
Advisory ID:       RHSA-2019:0910-01
Product:           Red Hat JBoss Fuse
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:0910
Issue date:        2019-04-30
CVE Names:         CVE-2014-0112 CVE-2017-7525 CVE-2017-7657 
=====================================================================

1. Summary:

A minor version update (from 7.2 to 7.3) is now available for Red Hat Fuse.
The purpose of this text-only errata is to inform you about the security
issues fixed in this release.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

This release of Red Hat Fuse 7.3 serves as a replacement for Red Hat Fuse
7.2, and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.

Security Fix(es):

* jackson-databind: A deserialization flaw was discovered in the
jackson-databind which could allow an unauthenticated user to perform code
execution by sending the maliciously crafted input to the readValue method
of the ObjectMapper. (CVE-2017-7525)

* struts2: ClassLoader manipulation via request parameters (CVE-2014-0112)

* jetty: HTTP request smuggling (CVE-2017-7657)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

Installation instructions are available from the Fuse 7.3.0 product
documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/

4. Bugs fixed (https://bugzilla.redhat.com/):

1091939 - CVE-2014-0112 struts2: ClassLoader manipulation via request parameters
1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
1595620 - CVE-2017-7657 jetty: HTTP request smuggling

5. References:

https://access.redhat.com/security/cve/CVE-2014-0112
https://access.redhat.com/security/cve/CVE-2017-7525
https://access.redhat.com/security/cve/CVE-2017-7657
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.3.0
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/html-single/release_notes/

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXMhsVtzjgjWX9erEAQiuIQ//WMwCvvPMgxvwwGQbhOTpgO41r7fSLPGP
amoRE0KzCUX0YCZbth5GsmX/yMrCJVyptMpOoZIiJa3v9dZRsN74EW++UCF0B3L3
+RGtrOp+oOI+SaqLIWg+mgiIGKWDpCbc3n58Rmxd+wbgp4L31I4ugT/wZdnXakuM
8MC5wPZ12KFnq2uIooUvkisV16+9hxSkX/E8SXlBm8hMC17yTIOfWL5mBcGmK+1B
z1i7MCW3Ql18ZGZm1n74ZOBlS5LEuInUz6zIeC7IXBA28U2lYw7i7/inPTXrdjkz
Q0SAQ5k6Jp0wWy1s5zNvQm1d03+NPOMFFcjxTcNJbkDM5Lo6eIMViD5GBRMtrLap
ExdwosS7V7J0dNdJ5Owo4aeI8m+AjnlRMvomiHCtTHAENOGCc1wbZQjjq2Tp5zG0
m23s+v6tOX56fBGWuqF6SpauF4FODRtoiTGpUkuVmC9/F9fVHlWUdne93B2PiG3G
kvbIR55Z0htil4rqcvhBfVksb4sj/sxQy9drwhMO2PUVom3N6givCq8K47toxJx3
TBPtDDJ5bEqknaUNbhbzfsKrc69qo8Zv6zzKRzmiIeny9QL8rJcj95NQMPM/+y3n
CVjct2us1/Y6XIEK76hgBlrBS5DJbk/w5i/q+LsKfkSsbB7AbvCmJQ2wi54mXVkg
bKht2vPZTfc=
=o3Ix
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce