Skip to content
OpenAdvisories
Critical RHSA-2017:1550 3 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 5

Published Sep 29, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 84

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 hornetq 0:2.3.25-21.SP19_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-common-api-eap6 0:1.0.39-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-common-impl-eap6 0:1.0.39-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-common-spi-eap6 0:1.0.39-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-core-api-eap6 0:1.0.39-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-core-impl-eap6 0:1.0.39-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-deployers-common-eap6 0:1.0.39-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-eap6 0:1.0.39-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-jdbc-eap6 0:1.0.39-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-spec-api-eap6 0:1.0.39-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 ironjacamar-validator-eap6 0:1.0.39-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-appclient 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-cli 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-client-all 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-clustering 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-cmp 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-configadmin 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-connector 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-console 0:2.5.17-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-controller 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-controller-client 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-core-security 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-deployment-repository 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-deployment-scanner 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-domain-http 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-domain-management 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-ee 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-ee-deployment 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-ejb3 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-embedded 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-host-controller 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jacorb 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jaxr 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jaxrs 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jdr 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jmx 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jpa 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jsf 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jsr77 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-logging 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-mail 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-management-client-content 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-messaging 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-modcluster 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-naming 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-network 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-osgi 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-osgi-configadmin 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-osgi-service 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-picketlink 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-platform-mbean 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-pojo 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-process-controller 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-protocol 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-remoting 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-sar 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-security 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-server 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-system-jmx 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-threads 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-transactions 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-version 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-web 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-webservices 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-weld 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-xts 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-hal 0:2.5.17-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-logmanager 0:1.5.7-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-marshalling 0:1.4.10-2.SP2_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-modules 0:1.3.9-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-appclient 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-bundles 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-core 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-domain 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-javadocs 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-modules-eap 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-product-eap 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-standalone 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-welcome-content-eap 0:7.5.16-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossts 1:4.17.42-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossweb 0:7.5.23-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jgroups 1:3.2.17-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 picketbox 0:4.1.6-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 resteasy 0:2.3.20-1.Final_redhat_1.1.ep6.el5

Vulnerabilities 3

  • Critical 9.1
    CVE-2016-5018 EPSS 10%

    Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.7
    CVE-2017-2595

    It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to aut…

    [UNKNOWN] wildfly
  • High 7.5
    CVE-2016-6796

    Apache Tomcat vulnerable to SecurityManager bypass

    A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Se…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven

References

  • article
    https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=6.4
  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1390515
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1390525
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1413028
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1456747
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1550.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-5018
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-5018
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-5018
  • article
    https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37
  • report
    https://access.redhat.com/security/cve/CVE-2016-6796
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6796
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6796
  • report
    https://access.redhat.com/security/cve/CVE-2017-2595
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-2595
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-2595