Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 security update

Fixed packages 108

Vulnerabilities 5

• High 8.1
  CVE-2018-8039 Public exploit

  Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.*

  It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the Ho…

  Apache Software Foundation Apache CXF org.apache.cxf:apache-cxf org.apache.cxf:cxf-rt-transports-http Maven
  Jul 2, 2018
• High 7.5
  CVE-2018-1000180

  Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator

  Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appea…

  bouncycastle bouncycastle org.bouncycastle:bcprov-jdk14 org.bouncycastle:bcprov-jdk15on Debian Ubuntu Maven
  Jun 5, 2018
• Medium 5.9
  CVE-2018-10237

  Denial of Service in Google Guava

  Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (w…

  druid guava-libraries com.google.guava:guava guava-libraries Debian Ubuntu Wolfi Maven
  Apr 26, 2018
• Medium 5.5
  CVE-2017-12624 Public exploit

  Improper Input Validation in Apache CXF

  Apache CXF supports sending and receiving attachments via either the JAX-WS or JAX-RS specifications. It is possible to craft a message attachment header that could lead to a Denial of Service (DoS) attack on a CXF web service provider. Both JAX-WS and JAX-RS…

  Apache Software Foundation Apache CXF org.apache.cxf:cxf-core Maven
  Nov 14, 2017
• Medium 5.5
  CVE-2018-10862

  Improper Limitation of a Pathname to a Restricted Directory in WildFly

  WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

  org.wildfly.core:wildfly-server Maven
  Jul 27, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/?version=7.1
• article
  https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.1/html-single/installation_guide/
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1515976
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1573391
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1588306
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1593527
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595332
• article
  https://issues.redhat.com/browse/JBEAP-14788
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2424.json
• report
  https://access.redhat.com/security/cve/CVE-2017-12624
• advisory
  https://www.cve.org/CVERecord?id=CVE-2017-12624
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2017-12624
• report
  https://access.redhat.com/security/cve/CVE-2018-8039
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-8039
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-8039
• article
  http://cxf.apache.org/security-advisories.data/CVE-2018-8039.txt.asc?version=1&modificationDate=1530184663000&api=v2
• report
  https://access.redhat.com/security/cve/CVE-2018-10237
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10237
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10237
• article
  https://github.com/google/guava/wiki/CVE-2018-10237
• article
  https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion
• report
  https://access.redhat.com/security/cve/CVE-2018-10862
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10862
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10862
• article
  https://snyk.io/research/zip-slip-vulnerability
• report
  https://access.redhat.com/security/cve/CVE-2018-1000180
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000180
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000180