Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.6 on RHEL 8 security update

Fixed packages 77

Vulnerabilities 12

• Critical 9.8
  CVE-2019-14540 Public exploit EPSS 11%

  Polymorphic Typing issue in FasterXML jackson-databind

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Sep 15, 2019
• Critical 9.8
  CVE-2019-16335

  Polymorphic Typing issue in FasterXML jackson-databind

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Sep 15, 2019
• Critical 9.8
  CVE-2019-16942

  Polymorphic Typing in FasterXML jackson-databind

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Oct 1, 2019
• Critical 9.8
  CVE-2019-16943

  jackson-databind polymorphic typing issue

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the …

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Oct 1, 2019
• Critical 9.8
  CVE-2019-17267

  Improper Input Validation in jackson-databind

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Oct 6, 2019
• Critical 9.8
  CVE-2019-17531

  jackson-databind polymorphic typing issue

  A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (versi…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Oct 12, 2019
• High 7.5
  CVE-2019-14888

  Undertow vulnerable to Uncontrolled Resource Consumption

  A vulnerability was found in the Undertow HTTP server in versions before 2.0.28.SP1 when listening on HTTPS. An attacker can target the HTTPS port to carry out a Denial Of Service (DOS) to make the service unavailable on SSL.

  Red Hat undertow undertow undertow Debian Ubuntu Maven
  Jan 23, 2020
• High 7.5
  CVE-2019-14892

  Polymorphic deserialization of malicious object in jackson-databind

  A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arb…

  Red Hat jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• High 7.5
  CVE-2019-14893

  Polymorphic deserialization of malicious object in jackson-databind

  A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods su…

  Red Hat jackson-databind jackson-databind com.fasterxml.jackson.core:jackson-databind Debian Ubuntu Maven
  Mar 2, 2020
• High 7.5
  CVE-2019-16869

  HTTP Request Smuggling in Netty

  Netty before 4.1.42.Final mishandles whitespace before the colon in HTTP headers (such as a "Transfer-Encoding : chunked" line), which leads to HTTP request smuggling.

  druid netty netty io.netty:netty Debian Ubuntu Wolfi Maven
  Sep 26, 2019
• Medium 6.5
  CVE-2019-10219 Public exploit

  The SafeHtml annotation in Hibernate-Validator does not properly guard against XSS attacks

  A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

  Hibernate hibernate-validator libhibernate-validator-java org.hibernate:hibernate-validator Debian Ubuntu Maven
  Nov 8, 2019
• Medium 5.4
  CVE-2019-14885

  A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system …

  Red Hat JBoss EAP
  Jan 23, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1738673
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1755831
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1755849
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1758167
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1758171
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1758182
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1758187
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1758191
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1758619
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1770615
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1772464
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1775293
• article
  https://issues.redhat.com/browse/JBEAP-17491
• article
  https://issues.redhat.com/browse/JBEAP-17541
• article
  https://issues.redhat.com/browse/JBEAP-17651
• article
  https://issues.redhat.com/browse/JBEAP-17652
• article
  https://issues.redhat.com/browse/JBEAP-17666
• article
  https://issues.redhat.com/browse/JBEAP-17773
• article
  https://issues.redhat.com/browse/JBEAP-17779
• article
  https://issues.redhat.com/browse/JBEAP-17789
• article
  https://issues.redhat.com/browse/JBEAP-17805
• article
  https://issues.redhat.com/browse/JBEAP-17836
• article
  https://issues.redhat.com/browse/JBEAP-17837
• article
  https://issues.redhat.com/browse/JBEAP-17887
• article
  https://issues.redhat.com/browse/JBEAP-17898
• article
  https://issues.redhat.com/browse/JBEAP-17905
• article
  https://issues.redhat.com/browse/JBEAP-17906
• article
  https://issues.redhat.com/browse/JBEAP-17940
• article
  https://issues.redhat.com/browse/JBEAP-17945
• article
  https://issues.redhat.com/browse/JBEAP-17974
• article
  https://issues.redhat.com/browse/JBEAP-17998
• article
  https://issues.redhat.com/browse/JBEAP-18169
• article
  https://issues.redhat.com/browse/JBEAP-18170
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_0161.json
• report
  https://access.redhat.com/security/cve/CVE-2019-10219
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10219
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10219
• article
  https://github.com/hibernate/hibernate-validator/commit/124b7dd6d9a4ad24d4d49f74701f05a13e56cee