Skip to content
OpenAdvisories
High RHSA-2018:2276 2 CVEs

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1 security update

Published Sep 13, 2024 · Updated Aug 5, 2026

Ecosystem: Red Hat

Fixed packages 28

ReleasePackageFixed in
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-apache-cxf 0:3.1.16-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-apache-cxf-rt 0:3.1.16-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-apache-cxf-services 0:3.1.16-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-apache-cxf-tools 0:3.1.16-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-wildfly 0:7.1.3-4.GA_redhat_3.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-wildfly-modules 0:7.1.3-4.GA_redhat_3.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-wss4j 0:2.1.12-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-wss4j-bindings 0:2.1.12-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-wss4j-policy 0:2.1.12-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-wss4j-ws-security-common 0:2.1.12-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-wss4j-ws-security-dom 0:2.1.12-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-wss4j-ws-security-policy-stax 0:2.1.12-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-wss4j-ws-security-stax 0:2.1.12-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7::el6 eap7-xml-security 0:2.0.10-1.redhat_1.1.ep7.el6
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-apache-cxf 0:3.1.16-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-apache-cxf-rt 0:3.1.16-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-apache-cxf-services 0:3.1.16-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-apache-cxf-tools 0:3.1.16-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-wildfly 0:7.1.3-4.GA_redhat_3.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-wildfly-modules 0:7.1.3-4.GA_redhat_3.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-wss4j 0:2.1.12-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-wss4j-bindings 0:2.1.12-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-wss4j-policy 0:2.1.12-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-wss4j-ws-security-common 0:2.1.12-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-wss4j-ws-security-dom 0:2.1.12-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-wss4j-ws-security-policy-stax 0:2.1.12-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-wss4j-ws-security-stax 0:2.1.12-1.redhat_1.1.ep7.el7
Red Hat · JBoss EAP 7 jboss_enterprise_application_platform:7.1::el7 eap7-xml-security 0:2.0.10-1.redhat_1.1.ep7.el7

Vulnerabilities 2

  • High 8.1
    CVE-2018-8039 Public exploit

    Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.*

    It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the Ho…

    Apache Software Foundation Apache CXF org.apache.cxf:apache-cxf org.apache.cxf:cxf-rt-transports-http Maven
  • Medium 5.5
    CVE-2018-10862

    Improper Limitation of a Pathname to a Restricted Directory in WildFly

    WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

    org.wildfly.core:wildfly-server Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1593527
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1595332
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2276.json
  • report
    https://access.redhat.com/security/cve/CVE-2018-8039
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-8039
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-8039
  • article
    http://cxf.apache.org/security-advisories.data/CVE-2018-8039.txt.asc?version=1&modificationDate=1530184663000&api=v2
  • report
    https://access.redhat.com/security/cve/CVE-2018-10862
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-10862
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-10862
  • article
    https://snyk.io/research/zip-slip-vulnerability