Critical RHSA-2017:3141 3 CVEs

Red Hat Security Advisory: rhvm-appliance security, bug fix, and enhancement update

Published Sep 16, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 1

Release	Package	Fixed in
Red Hat · RHEL 7 enterprise_linux:7::hypervisor	rhvm-appliance	1:4.1.20171102.0-1.el7

Vulnerabilities 3

Critical 9.8

CVE-2017-7525 Public exploit EPSS 38%

jackson-databind is vulnerable to a deserialization flaw

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven

Feb 6, 2018
High 7.5

CVE-2014-9970

Exposure of Sensitive Information to an Unauthorized Actor in Apache Jasypt

jasypt before 1.9.2 allows a timing attack against the password hash comparison.

org.jasypt:jasypt jasypt jasypt Debian Ubuntu Maven

May 21, 2017
High 7.0

CVE-2017-7536

Privilege Escalation in Hibernate Validator

In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to access the private members of the class, are granted to Hibernate Validator, a potential privilege esca…

Red Hat hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Maven

Jan 10, 2018

References

article
https://access.redhat.com/security/updates/classification/#important
report
https://bugzilla.redhat.com/show_bug.cgi?id=1455566
report
https://bugzilla.redhat.com/show_bug.cgi?id=1462702
report
https://bugzilla.redhat.com/show_bug.cgi?id=1465573
report
https://bugzilla.redhat.com/show_bug.cgi?id=1496586
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3141.json
report
https://access.redhat.com/security/cve/CVE-2014-9970
advisory
https://www.cve.org/CVERecord?id=CVE-2014-9970
advisory
https://nvd.nist.gov/vuln/detail/CVE-2014-9970
report
https://access.redhat.com/security/cve/CVE-2017-7525
advisory
https://www.cve.org/CVERecord?id=CVE-2017-7525
advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-7525
report
https://access.redhat.com/security/cve/CVE-2017-7536
advisory
https://www.cve.org/CVERecord?id=CVE-2017-7536
advisory
https://nvd.nist.gov/vuln/detail/CVE-2017-7536