Red Hat Security Advisory: eap7-jboss-ec2-eap security update

Fixed packages 4

Vulnerabilities 6

• Critical 9.8
  CVE-2017-5645 Public exploit Scanner template EPSS 89%

  Deserialization of Untrusted Data in Log4j

  In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

  Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Apr 17, 2017
• Critical 9.8
  CVE-2019-17571 Public exploit EPSS 70%

  Deserialization of Untrusted Data in Log4j

  Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log dat…

  Apache Software Foundation Log4j druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  Dec 20, 2019
• High 7.5
  CVE-2014-9970

  Exposure of Sensitive Information to an Unauthorized Actor in Apache Jasypt

  jasypt before 1.9.2 allows a timing attack against the password hash comparison.

  org.jasypt:jasypt jasypt jasypt Debian Ubuntu Maven
  May 21, 2017
• High 7.0
  CVE-2017-7536

  Privilege Escalation in Hibernate Validator

  In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege esca…

  Red Hat hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Maven
  Jan 10, 2018
• Medium 6.5
  CVE-2017-2582

  keycloak-core discloses system properties

  It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the atta…

  Red Hat keycloak org.keycloak:keycloak-core Maven
  Jul 26, 2018
• Unscored —
  CVE-2015-6644

  Bouncy Castle in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to obtain sensitive information…

  bouncycastle bouncycastle Debian Ubuntu
  Jan 6, 2016

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/version-7.0/
• article
  https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/version-7.0/installation-guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1410481
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1443635
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1444015
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1455566
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1465573
• article
  https://issues.redhat.com/browse/JBEAP-11487
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_2811.json
• report
  https://access.redhat.com/security/cve/CVE-2014-9970
• advisory
  https://www.cve.org/CVERecord?id=CVE-2014-9970
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2014-9970
• report
  https://access.redhat.com/security/cve/CVE-2015-6644
• advisory
  https://www.cve.org/CVERecord?id=CVE-2015-6644
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2015-6644
• report
  https://access.redhat.com/security/cve/CVE-2017-2582
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-2582
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-2582
• report
  https://access.redhat.com/security/cve/CVE-2017-5645
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5645
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5645
• report
  https://access.redhat.com/security/cve/CVE-2017-7536
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-7536
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-7536
• report
  https://access.redhat.com/security/cve/CVE-2019-17571
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1785616
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17571
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17571