Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update

Fixed packages 34

Vulnerabilities 5

• Critical 9.8
  CVE-2017-5645 Public exploit Scanner template EPSS 89%

  Deserialization of Untrusted Data in Log4j

  In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

  Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Apr 17, 2017
• High 7.5
  CVE-2014-9970

  Exposure of Sensitive Information to an Unauthorized Actor in Apache Jasypt

  jasypt before 1.9.2 allows a timing attack against the password hash comparison.

  org.jasypt:jasypt jasypt jasypt Debian Ubuntu Maven
  May 21, 2017
• High 7.0
  CVE-2017-7536

  Privilege Escalation in Hibernate Validator

  In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege esca…

  Red Hat hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Maven
  Jan 10, 2018
• Medium 6.5
  CVE-2017-2582

  keycloak-core discloses system properties

  It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the atta…

  Red Hat keycloak org.keycloak:keycloak-core Maven
  Jul 26, 2018
• Unscored —
  CVE-2015-6644

  Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information…

  bouncycastle bouncycastle Debian Ubuntu
  Jan 6, 2016

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/version-7.0/
• article
  https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/version-7.0/installation-guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1410481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1443635
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1444015
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1455566
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1465573
• article
  https://issues.redhat.com/browse/JBEAP-11485
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2808.json
• report
  https://access.redhat.com/security/cve/CVE-2014-9970
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-9970
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-9970
• report
  https://access.redhat.com/security/cve/CVE-2015-6644
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-6644
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-6644
• report
  https://access.redhat.com/security/cve/CVE-2017-2582
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-2582
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-2582
• report
  https://access.redhat.com/security/cve/CVE-2017-5645
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5645
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5645
• report
  https://access.redhat.com/security/cve/CVE-2017-7536
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-7536
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-7536