Skip to content
OpenAdvisories
Critical RHSA-2017:1552 3 CVEs

Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update

Published Sep 29, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 jboss-ec2-eap 0:7.5.16-1.Final_redhat_1.ep6.el6
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 jboss-ec2-eap-samples 0:7.5.16-1.Final_redhat_1.ep6.el6

Vulnerabilities 3

  • Critical 9.1
    CVE-2016-5018 EPSS 10%

    Authentication Bypass Using an Alternate Path or Channel in Apache Tomcat

    In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured SecurityManager via a Tomcat utility method that was accessible to web applications.

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven
  • High 7.7
    CVE-2017-2595

    It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to aut…

    [UNKNOWN] wildfly
  • High 7.5
    CVE-2016-6796

    Apache Tomcat vulnerable to SecurityManager bypass

    A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured SecurityManager via manipulation of the configuration parameters for the JSP Se…

    Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven

References

  • article
    https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/?version=6.4
  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1390515
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1390525
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1413028
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1552.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-5018
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-5018
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-5018
  • article
    https://tomcat.apache.org/security-6.html#Fixed_in_Apache_Tomcat_6.0.47
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.72
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.5_and_8.0.37
  • report
    https://access.redhat.com/security/cve/CVE-2016-6796
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-6796
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-6796
  • report
    https://access.redhat.com/security/cve/CVE-2017-2595
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-2595
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-2595