Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.2 for RHEL 7

Fixed packages 87

Vulnerabilities 3

• Critical 9.8
  CVE-2018-8088 EPSS 15%

  Improper Access Control in SLF4J

  org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 late…

  org.slf4j:slf4j-ext libslf4j-java Debian Maven
  Mar 20, 2018
• Medium 5.5
  CVE-2018-1047 Public exploit

  Improper Input Validation in org.wildfly:wildfly-undertow

  A flaw was found in Wildfly 9.x. A path traversal vulnerability through the org.wildfly.extension.undertow.deployment.ServletResourceManager.getResource method could lead to information disclosure of arbitrary local files.

  Red Hat wildfly undertow org.wildfly:wildfly-undertow Ubuntu Maven
  Jan 24, 2018
• Medium 5.4
  CVE-2018-1067

  Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow

  In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and vali…

  [UNKNOWN] undertow undertow undertow Debian Ubuntu Maven
  May 21, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1528361
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1548909
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1550671
• article
  https://issues.redhat.com/browse/JBEAP-14136
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1247.json
• report
  https://access.redhat.com/security/cve/CVE-2018-1047
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1047
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1047
• report
  https://access.redhat.com/security/cve/CVE-2018-1067
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1067
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1067
• report
  https://access.redhat.com/security/cve/CVE-2018-8088
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-8088
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-8088