Skip to content
OpenAdvisories
Critical RHSA-2018:1450 8 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.20 security update

Published Sep 20, 2024 · Updated Aug 9, 2026

Ecosystem: Red Hat

Fixed packages 74

ReleasePackageFixed in
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 codehaus-jackson 0:1.9.9-12.redhat_6.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 codehaus-jackson-core-asl 0:1.9.9-12.redhat_6.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 codehaus-jackson-jaxrs 0:1.9.9-12.redhat_6.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 codehaus-jackson-mapper-asl 0:1.9.9-12.redhat_6.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 codehaus-jackson-xc 0:1.9.9-12.redhat_6.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 hornetq 0:2.3.25-26.SP24_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-appclient 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-cli 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-client-all 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-clustering 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-cmp 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-configadmin 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-connector 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-controller 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-controller-client 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-core-security 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-deployment-repository 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-deployment-scanner 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-domain-http 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-domain-management 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-ee 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-ee-deployment 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-ejb3 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-embedded 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-host-controller 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jacorb 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jaxr 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jaxrs 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jdr 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jmx 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jpa 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jsf 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-jsr77 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-logging 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-mail 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-management-client-content 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-messaging 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-modcluster 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-naming 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-network 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-osgi 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-osgi-configadmin 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-osgi-service 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-picketlink 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-platform-mbean 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-pojo 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-process-controller 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-protocol 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-remoting 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-sar 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-security 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-server 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-system-jmx 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-threads 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-transactions 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-version 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-web 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-webservices 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-weld 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jboss-as-xts 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-appclient 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-bundles 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-core 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-domain 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-javadocs 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-modules-eap 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-product-eap 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-standalone 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossas-welcome-content-eap 0:7.5.20-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossts 1:4.17.43-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jbossweb 0:7.5.28-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 jgroups 1:3.2.18-1.Final_redhat_1.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 lucene-solr 0:3.6.2-8.redhat_9.1.ep6.el5
Red Hat · JBoss EAP 6 jboss_enterprise_application_platform:6::el5 picketbox 0:4.1.7-1.Final_redhat_1.1.ep6.el5

Vulnerabilities 8

  • Critical 9.8
    CVE-2017-15095

    jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

    A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This i…

    FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  • Critical 9.8
    CVE-2017-17485 Public exploit EPSS 50%

    jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass

    FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readVa…

    jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  • Critical 9.8
    CVE-2017-7525 Public exploit EPSS 38%

    jackson-databind is vulnerable to a deserialization flaw

    A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper.

    FasterXML jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  • Critical 9.8
    CVE-2018-7489 Public exploit EPSS 20%

    FasterXML jackson-databind allows unauthenticated remote code execution

    FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JS…

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • Critical 9.8
    CVE-2018-8088 EPSS 15%

    Improper Access Control in SLF4J

    org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 late…

    libslf4j-java org.slf4j:slf4j-ext Debian Maven
  • High 7.5
    CVE-2017-3163

    Improper Limitation of a Pathname ('Path Traversal') in org.apache.solr:solr-core

    When using the Index Replication feature, Apache Solr nodes can pull index files from a master/leader node using an HTTP API which accepts a file name. However, Solr before 5.5.4 and 6.x before 6.4.1 did not validate the file name, hence it was possible to cr…

    Apache Software Foundation Apache Solr org.apache.solr:solr-core lucene-solr Debian Ubuntu Maven
  • High 7.2
    CVE-2016-4978

    Apache ActiveMQ Artemis RCE Via Deserialization Gadget Chain

    The getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component in Apache ActiveMQ Artemis before 1.4.0 might allow remote authenticated users with permission to send messages to the Art…

    org.apache.activemq:artemis-pom Maven
  • Medium 5.9
    CVE-2018-1304 Public exploit EPSS 17%

    Apache Tomcat unauthorized access vulnerability

    The URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled in Apache Tomcat 9.0.0.M1 to 9.0.4, 8.5.0 to 8.5.27, 8.0.0.RC1 to 8.0.49 and 7.0.0 to 7.0.84 when used as part of a security constraint definition. This …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat7 Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • article
    https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/?version=6.4
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1379207
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1454783
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1506612
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1528565
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1548289
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1548909
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1549276
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1559009
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1559012
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1559017
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1450.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-4978
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-4978
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-4978
  • report
    https://access.redhat.com/security/cve/CVE-2017-3163
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-3163
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-3163
  • report
    https://access.redhat.com/security/cve/CVE-2017-7525
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1462702
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-7525
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-7525
  • report
    https://access.redhat.com/security/cve/CVE-2017-15095
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-15095
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-15095
  • article
    https://access.redhat.com/solutions/3442891
  • report
    https://access.redhat.com/security/cve/CVE-2017-17485
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-17485
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-17485
  • report
    https://access.redhat.com/security/cve/CVE-2018-1304
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1304
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1304
  • article
    https://tomcat.apache.org/security-7.html#Fixed_in_Apache_Tomcat_7.0.85
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.0.50
  • article
    https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.28
  • report
    https://access.redhat.com/security/cve/CVE-2018-7489
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-7489
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-7489