Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 5.2 security update

Fixed packages 2

Vulnerabilities 2

• Critical 9.8
  CVE-2017-5645 Public exploit Scanner template EPSS 89%

  Deserialization of Untrusted Data in Log4j

  In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

  Apache Software Foundation Apache Log4j apache-log4j2 org.apache.logging.log4j:log4j-core Debian Ubuntu Maven
  Apr 17, 2017
• Critical 9.8
  CVE-2019-17571 Public exploit EPSS 70%

  Deserialization of Untrusted Data in Log4j

  Included in Log4j 1.2 is a SocketServer class that is vulnerable to deserialization of untrusted data which can be exploited to remotely execute arbitrary code when combined with a deserialization gadget when listening to untrusted network traffic for log dat…

  Apache Software Foundation Log4j druid apache-log4j1.2 Debian Ubuntu Wolfi Maven
  Dec 20, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1443635
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_3399.json
• report
  https://access.redhat.com/security/cve/CVE-2017-5645
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-5645
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-5645
• report
  https://access.redhat.com/security/cve/CVE-2019-17571
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1785616
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-17571
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-17571