Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 7

Fixed packages 95

Vulnerabilities 3

• Critical 9.8
  CVE-2017-5645 Public exploit Scanner template EPSS 89%

  Deserialization of Untrusted Data in Log4j

  In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

  Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Apr 17, 2017
• Critical 9.8
  CVE-2017-7525 Public exploit EPSS 38%

  jackson-databind is vulnerable to a deserialization flaw

  A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

  FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  Feb 6, 2018
• High 7.5
  CVE-2017-5664 EPSS 17%

  Improper Handling of Exceptional Conditions in Apache Tomcat

  The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is prese…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  Jun 6, 2017

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform?version=6.4/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1443635
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1459158
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1462702
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2636.json
• report
  https://access.redhat.com/security/cve/CVE-2017-5645
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5645
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5645
• report
  https://access.redhat.com/security/cve/CVE-2017-5664
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5664
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5664
• article
  https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78
• article
  https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44
• article
  https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15
• report
  https://access.redhat.com/security/cve/CVE-2017-7525
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-7525
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-7525