exploit the possibilities

Red Hat Security Advisory 2020-2564-01

Red Hat Security Advisory 2020-2564-01
Posted Jun 16, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-2564-01 - Red Hat JBoss Enterprise Application Platform CD16 is a platform for Java applications based on the WildFly application runtime. This release of Red Hat JBoss Enterprise Application Platform CD16 includes bug fixes and enhancements. Issues addressed include code execution and deserialization vulnerabilities.

tags | advisory, java, vulnerability, code execution
systems | linux, redhat
advisories | CVE-2018-14718, CVE-2018-14719, CVE-2018-14720, CVE-2018-14721, CVE-2018-19360, CVE-2018-19361, CVE-2018-19362
MD5 | 5e23d50a970191a950b3c89d8a42b325

Red Hat Security Advisory 2020-2564-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: EAP Continuous Delivery Technical Preview Release 16 security update
Advisory ID: RHSA-2020:2564-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2020:2564
Issue date: 2020-06-15
CVE Names: CVE-2018-14718 CVE-2018-14719 CVE-2018-14720
CVE-2018-14721 CVE-2018-19360 CVE-2018-19361
CVE-2018-19362
====================================================================
1. Summary:

This is a security update for JBoss EAP Continuous Delivery 16.0.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Enterprise Application Platform CD16 is a platform for Java
applications based on the WildFly application runtime.

This release of Red Hat JBoss Enterprise Application Platform CD16 includes
bug fixes and enhancements.

Security Fix(es):

* jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class
(CVE-2018-14721)
* jackson-databind: arbitrary code execution in blaze-ds-opt and
blaze-ds-core classes (CVE-2018-14719)
* jackson-databind: exfiltration/XXE in some JDK classes (CVE-2018-14720)
* jackson-databind: improper polymorphic deserialization in
jboss-common-core class (CVE-2018-19362)
* jackson-databind: improper polymorphic deserialization in
axis2-transport-jms class (CVE-2018-19360)
* jackson-databind: improper polymorphic deserialization in openjpa class
(CVE-2018-19361)
* jackson-databind: arbitrary code execution in slf4j-ext class
(CVE-2018-14718)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

You must restart the JBoss server process for the update to take effect.

The References section of this erratum contains a download link (you must
log in to download the update)

4. Bugs fixed (https://bugzilla.redhat.com/):

1666415 - CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class
1666418 - CVE-2018-14719 jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes
1666423 - CVE-2018-14720 jackson-databind: exfiltration/XXE in some JDK classes
1666428 - CVE-2018-14721 jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class
1666482 - CVE-2018-19360 jackson-databind: improper polymorphic deserialization in axis2-transport-jms class
1666484 - CVE-2018-19361 jackson-databind: improper polymorphic deserialization in openjpa class
1666489 - CVE-2018-19362 jackson-databind: improper polymorphic deserialization in jboss-common-core class

5. References:

https://access.redhat.com/security/cve/CVE-2018-14718
https://access.redhat.com/security/cve/CVE-2018-14719
https://access.redhat.com/security/cve/CVE-2018-14720
https://access.redhat.com/security/cve/CVE-2018-14721
https://access.redhat.com/security/cve/CVE-2018-19360
https://access.redhat.com/security/cve/CVE-2018-19361
https://access.redhat.com/security/cve/CVE-2018-19362
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXueqxdzjgjWX9erEAQgwCA//ZwbtBt/RaVyCEfmNxSoEaXff9lQ1udLD
iMuq9a4MloE+4mfqibyAJLFCr4puqeIcfIR1jwbLUsSPCV2enlo08xAkmtU8d6/0
DADRcFxt93eAZBd8hbm1GP4fAI0y8c/PvevuO5n6mkf0fw0LO3wY5EnpvF673oHz
yUjgjgi/v6jTk8LqhOW5gNDDbOyRj7brLHE3t3WFFBE1Osu5fD2g3+yjNk+ONMFK
sEvErBebBHhOH1OSwCVSWDVa+OYAeKWua5mH9UiILD2sWqyMY0x+4JcDQMsR4S2m
QgEunCBlZrD4RxAJcW4PWeEmTBbt8VAyXG6PlnmMEVYlDIpHAAcDepU2dOBompWZ
H8jGzMxHmmrjeMyVls6poAuIK0Rro8W/fSEHbHH4SRuO0E59FLGx5WD2lhgnQ9l8
Q0IUXiGdB+MtD8njwGEqRlnZ8Ipfmsgauoe32n0fvQfQPUXAf9GP4+OcYkl72kXr
2ilC1YmbGwUyA3vXekHAQ4spWUd83B++sFknoG/0KmgRNnCMwXjkYT3tjiJaz56U
afl9fBmXV/CKvL0A1KgzML8h8/aGu/IF1tpuDx+xwR9bJdn0fvN/Yi7FaPqcvn53
bwZ64TxYseGNPDpcUbr6qFiEzeNS9h9Vn3JwmbMYY20qytMr1K5ZZcWw2YbdwOG0
Lo4jPNpH0Hw=WCi+
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

July 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jul 1st
    15 Files
  • 2
    Jul 2nd
    17 Files
  • 3
    Jul 3rd
    0 Files
  • 4
    Jul 4th
    0 Files
  • 5
    Jul 5th
    0 Files
  • 6
    Jul 6th
    0 Files
  • 7
    Jul 7th
    0 Files
  • 8
    Jul 8th
    0 Files
  • 9
    Jul 9th
    0 Files
  • 10
    Jul 10th
    0 Files
  • 11
    Jul 11th
    0 Files
  • 12
    Jul 12th
    0 Files
  • 13
    Jul 13th
    0 Files
  • 14
    Jul 14th
    0 Files
  • 15
    Jul 15th
    0 Files
  • 16
    Jul 16th
    0 Files
  • 17
    Jul 17th
    0 Files
  • 18
    Jul 18th
    0 Files
  • 19
    Jul 19th
    0 Files
  • 20
    Jul 20th
    0 Files
  • 21
    Jul 21st
    0 Files
  • 22
    Jul 22nd
    0 Files
  • 23
    Jul 23rd
    0 Files
  • 24
    Jul 24th
    0 Files
  • 25
    Jul 25th
    0 Files
  • 26
    Jul 26th
    0 Files
  • 27
    Jul 27th
    0 Files
  • 28
    Jul 28th
    0 Files
  • 29
    Jul 29th
    0 Files
  • 30
    Jul 30th
    0 Files
  • 31
    Jul 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close