Red Hat Security Advisory: rhvm-appliance security update

Fixed packages 1

Vulnerabilities 7

• High 8.5
  CVE-2018-10915

  A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its inte…

  PostgreSQL Global Development Group PostgreSQL postgresql15 postgresql-9.3 Ubuntu Alpine
  Aug 9, 2018
• High 8.1
  CVE-2018-8039 Public exploit

  Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.*

  It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the Ho…

  Apache Software Foundation Apache CXF org.apache.cxf:apache-cxf org.apache.cxf:cxf-rt-transports-http Maven
  Jul 2, 2018
• High 7.5
  CVE-2018-1000180

  Bouncy Castle has a flaw in the Low-level interface to RSA key pair generator

  Bouncy Castle BC 1.54 - 1.59, BC-FJA 1.0.0, BC-FJA 1.0.1 and earlier have a flaw in the Low-level interface to RSA key pair generator, specifically RSA Key Pairs generated in low-level API with added certainty may have less M-R tests than expected. This appea…

  bouncycastle bouncycastle org.bouncycastle:bcprov-jdk14 org.bouncycastle:bcprov-jdk15on Debian Ubuntu Maven
  Jun 5, 2018
• Medium 6.5
  CVE-2018-1114

  Uncontrolled Resource Consumption in Undertow

  It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust. This leads to a file handler leak.

  Red Hat undertow undertow undertow Debian Ubuntu Maven
  Sep 11, 2018
• Medium 5.9
  CVE-2018-10237

  Denial of Service in Google Guava

  Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (w…

  druid guava-libraries com.google.guava:guava guava-libraries Debian Ubuntu Wolfi Maven
  Apr 26, 2018
• Medium 5.5
  CVE-2018-10862

  Improper Limitation of a Pathname to a Restricted Directory in WildFly

  WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .war archives to overwrite arbitrary files. This is an instance of the 'Zip Slip' vulnerability.

  org.wildfly.core:wildfly-server Maven
  Jul 27, 2018
• Medium 5.4
  CVE-2018-1067

  Improper Neutralization of CRLF Sequences in HTTP Headers in Undertow

  In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the injection of arbitrary HTTP headers, and also response splitting, due to insufficient sanitization and vali…

  [UNKNOWN] undertow undertow undertow Debian Ubuntu Maven
  May 21, 2018

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1550671
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1573045
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1573391
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1588306
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1593527
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1595332
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1609891
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1616249
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2643.json
• report
  https://access.redhat.com/security/cve/CVE-2018-1067
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1067
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1067
• report
  https://access.redhat.com/security/cve/CVE-2018-1114
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1114
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1114
• article
  https://bugs.openjdk.java.net/browse/JDK-6956385
• article
  https://issues.jboss.org/browse/UNDERTOW-1338
• report
  https://access.redhat.com/security/cve/CVE-2018-8039
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-8039
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-8039
• article
  http://cxf.apache.org/security-advisories.data/CVE-2018-8039.txt.asc?version=1&modificationDate=1530184663000&api=v2
• report
  https://access.redhat.com/security/cve/CVE-2018-10237
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10237
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10237
• article
  https://github.com/google/guava/wiki/CVE-2018-10237
• article
  https://groups.google.com/forum/#!topic/guava-announce/xqWALw4W1vs/discussion
• report
  https://access.redhat.com/security/cve/CVE-2018-10862
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10862
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10862
• article
  https://snyk.io/research/zip-slip-vulnerability
• report
  https://access.redhat.com/security/cve/CVE-2018-10915
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-10915
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-10915
• article
  https://www.postgresql.org/about/news/1878/
• report
  https://access.redhat.com/security/cve/CVE-2018-1000180
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-1000180
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-1000180