Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update

Fixed packages 2

Vulnerabilities 4

• Critical 9.8
  CVE-2017-5645 Public exploit Scanner template EPSS 89%

  Deserialization of Untrusted Data in Log4j

  In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

  Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Apr 17, 2017
• Critical 9.8
  CVE-2017-7525 Public exploit EPSS 38%

  jackson-databind is vulnerable to a deserialization flaw

  A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

  FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  Feb 6, 2018
• Critical 9.8
  CVE-2019-17571 Public exploit EPSS 70%

  Deserialization of Untrusted Data in Log4j

  Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log dat…

  Apache Software Foundation Log4j druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  Dec 20, 2019
• High 7.5
  CVE-2017-5664 EPSS 17%

  Improper Handling of Exceptional Conditions in Apache Tomcat

  The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error page. This means that the request is prese…

  Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Ubuntu Maven
  Jun 6, 2017

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform?version=6.4/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1443635
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1459158
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1462702
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2638.json
• report
  https://access.redhat.com/security/cve/CVE-2017-5645
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5645
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5645
• report
  https://access.redhat.com/security/cve/CVE-2017-5664
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5664
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5664
• article
  https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.78
• article
  https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.44
• article
  https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.15
• report
  https://access.redhat.com/security/cve/CVE-2017-7525
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-7525
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-7525
• report
  https://access.redhat.com/security/cve/CVE-2019-17571
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1785616
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17571
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17571