Red Hat Security Advisory: eap7-jboss-ec2-eap security update

Fixed packages 4

Vulnerabilities 7

• Critical 9.8
  CVE-2017-12629 Public exploit Scanner template EPSS 92%

  Remote code execution occurs in Apache Solr

  Remote code execution occurs in Apache Solr before 7.1 with Apache Lucene before 7.1 by exploiting XXE in conjunction with use of a Config API add-listener command to reach the RunExecutableListener class. Elasticsearch, although it uses Lucene, is NOT vulner…

  org.apache.solr:solr-core lucene-solr lucene-solr Debian Ubuntu Maven
  Oct 14, 2017
• High 7.5
  CVE-2016-6346

  Denial of service in JBoss resteasy

  RESTEasy enables GZIPInterceptor, which allows remote attackers to cause a denial of service via unspecified vectors.

  resteasy resteasy3.0 org.jboss.resteasy:resteasy-jaxrs Debian Ubuntu Maven
  Sep 7, 2016
• High 7.5
  CVE-2017-7561

  Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP

  Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.

  Red Hat RESTEasy resteasy3.0 resteasy3.0 Debian Ubuntu Maven
  Sep 13, 2017
• Medium 6.1
  CVE-2017-7559

  Undertow vulnerable to Request Smuggling

  In Undertow 2.x before 2.0.0.Alpha2, 1.4.x before 1.4.17.Final, and 1.3.x before 1.3.31.Final, it was found that the fix for CVE-2017-2666 was incomplete and invalid characters are still allowed in the query string and path parameters. This could be exploited…

  Red Hat undertow undertow undertow Debian Ubuntu Maven
  Jan 10, 2018
• Medium 5.5
  CVE-2017-12167

  It was found in EAP 7 before 7.0.9 that properties based files of the management and the application realm configuratio…

  Red Hat EAP-7
  Jul 26, 2018
• Low 2.6
  CVE-2017-12165

  Undertow Request Smuggling vulnerability

  It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possible http request smuggling.

  Red Hat undertow undertow undertow Debian Ubuntu Maven
  Jul 27, 2018
• Unscored —
  CVE-2017-12189

  It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performe…

  Red Hat Red Hat JBoss Enterprise Application Platform
  Jan 10, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/version-7.0/
• article
  https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/version-7.0/installation-guide/
• article
  https://access.redhat.com/documentation/en/jboss-enterprise-application-platform/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1372120
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1481665
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1483823
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1490301
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1491612
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1499631
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1501529
• article
  https://issues.redhat.com/browse/JBEAP-12351
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0005.json
• report
  https://access.redhat.com/security/cve/CVE-2016-6346
• advisory
  https://www.cve.org/CVERecord?id=CVE-2016-6346
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2016-6346
• report
  https://access.redhat.com/security/cve/CVE-2017-7559
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-7559
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-7559
• report
  https://access.redhat.com/security/cve/CVE-2017-7561
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-7561
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-7561
• report
  https://access.redhat.com/security/cve/CVE-2017-12165
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-12165
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-12165
• report
  https://access.redhat.com/security/cve/CVE-2017-12167
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-12167
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-12167
• report
  https://access.redhat.com/security/cve/CVE-2017-12189
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-12189
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-12189
• report
  https://access.redhat.com/security/cve/CVE-2017-12629
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-12629
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-12629
• article
  https://access.redhat.com/security/vulnerabilities/CVE-2017-12629