-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Application Platform 6.4.21 security update Advisory ID: RHSA-2018:2740-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2018:2740 Issue date: 2018-09-24 CVE Names: CVE-2017-2582 CVE-2017-7536 CVE-2018-1336 CVE-2018-10237 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss Enterprise Application Platform 6.4 for Red Hat Enterprise Linux. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 6.4.21 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.20, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): * hibernate-validator: Privilege escalation when running under the security manager (CVE-2017-7536) * guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service (CVE-2018-10237) * picketlink: The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml (CVE-2017-2582) * jbossweb: tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. The CVE-2017-2582 issue was discovered by Hynek Mlnarik (Red Hat) and the CVE-2017-7536 issue was discovered by Gunnar Morling (Red Hat). 3. Solution: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1261190 - [GSS](6.4.z) Upgrade jboss-ejb-client from 1.0.40 to 1.0.41 1410481 - CVE-2017-2582 picketlink, keycloak: SAML request parser replaces special strings with system properties 1465573 - CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager 1570200 - [GSS](6.4.z) Upgrade JBoss Modules from 1.3.10 to 1.3.11 1573391 - CVE-2018-10237 guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service 1578830 - (6.4.z) Upgrade hibernate-validator from 4.3.3 to 4.3.4 1580440 - [GSS](6.4.z) Upgrade xnio from 3.0.16 to 3.0.17 1594389 - [GSS](6.4.z) The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml 1602226 - [GSS](6.4.z) Upgrade xerces from 2.9.1.redhat-6 to 2.9.1.redhat-8 1606334 - [GSS](6.4.z) Upgrade JBoss VFS from 3.2.12 to 3.2.13 1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS 1610355 - [GSS](6.4.z) Upgrade HornetQ from 2.3.25.SP24 to 2.3.25.SP28 1610742 - [GSS](6.4.z) Upgrade JBoss Web from 7.5.28 to 7.5.29 1611770 - [GSS](6.4.z) Upgrade Ironjacamar from 1.0.41 to 1.0.42 1614448 - [GSS](6.4.z) Upgrade Jackson from 1.9.9.redhat-6 to 1.9.9.redhat-7 1615347 - [GSS](6.4.z) Upgrade PicketLink from 2.5.4.SP18-redhat-1 to 2.5.4.SP18-redhat-2 1615380 - [GSS](6.4.z) Upgrade Guava from 13.0.1.redhat-2 to 13.0.1.redhat-3 5. References: https://access.redhat.com/security/cve/CVE-2017-2582 https://access.redhat.com/security/cve/CVE-2017-7536 https://access.redhat.com/security/cve/CVE-2018-1336 https://access.redhat.com/security/cve/CVE-2018-10237 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/6.4/ https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW6lbXtzjgjWX9erEAQgvuhAAmWjRjX6+cckdgzHrBqY86ABFz+T6rvhW xKr+NPFA32mvWqSTs5Faasvp4E360/j1b3SGKb7xw9zeMubbyc8a0qdOyszxQ9VU UcUgU0Yd5qOdipaqEKtKQIKwTR/px4Vx8PuFLoDfQ9VcTTCUS7061G6FBwmTD6Ur iN2UMxIicJwORdTpcmLJyWWSzM5fXFlgua6cP3ybfZ3BJz1XfmBhVu4uXAZJbsdt 6MCslgIloWAhTo4CS/Wbnl0LTFrUrKxsNMCwRV8ZvtyYpBSiAh9R/dMtippcKfuN AaEyvK1HYFe0tEvMXVgHullihFXS3+E9EhGhfYueuZCwcLmSk/Yk1/r2II7Ci1FX ZnUTNxaK7FMXivFl5ln8m82B+icFEzdvZg61P8ARs6lRZTveVJ8j14AijtUPh+RL ePPF+o1MKDZDavWXz7gv8B4cYFdmu3ZnyZAWt+OcGfdJ0AafitnlRbxhIjOrMT9/ HQUfLULPMsG5WKmAOezKsrwDEAtQ27TBeoB0kDz2eJoFYOJ2ebtJpy87D6Omc+zF hT1IDlGJfCc4x79GlEcShzJrCF8k6kpXzEPbqj/jQmPRV0pwK8yP7Ji1PTZmjXM4 WadUl98BuLTTh5wiF18Am3ag9cWuhCA6x1BCV9teTJiLBilYwOGHW2Pi+pSM8krT VJ9QX/0XtOQ= =Kz1/ -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce