Skip to content
OpenAdvisories
Medium RHSA-2017:3219 1 CVE

Red Hat Security Advisory: jboss-ec2-eap security, bug fix, and enhancement update for EAP 6.4.18

Published Sep 29, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 jboss-ec2-eap 0:7.5.18-1.Final_redhat_1.ep6.el6
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el6 jboss-ec2-eap-samples 0:7.5.18-1.Final_redhat_1.ep6.el6

Vulnerabilities 1

  • Medium 6.5
    CVE-2017-2582

    keycloak-core discloses system properties

    It was found that while parsing the SAML messages the StaxParserUtil class of keycloak before 2.5.1 replaces special strings for obtaining attribute values with system property. This could allow an attacker to determine values of system properties at the atta…

    Red Hat keycloak org.keycloak:keycloak-core Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1410481
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3219.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-2582
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-2582
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-2582