Red Hat JBoss Enterprise Application Platform: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 8

• Critical 9.8
  CVE-2017-15095

  jackson-databind vulnerable to deserialization flaw leading to unauthenticated remote code execution

  A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to the readValue method of the ObjectMapper. This i…

  FasterXML jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Feb 6, 2018
• Critical 9.8
  CVE-2017-17485 Public exploit EPSS 50%

  jackson-databind vulnerable to remote code execution due to incorrect deserialization and blocklist bypass

  FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw. This is exploitable by sending maliciously crafted JSON input to the readVa…

  jackson-databind com.fasterxml.jackson.core:jackson-databind jackson-databind Debian Ubuntu Maven
  Jan 10, 2018
• High 8.8
  CVE-2017-15089

  Deserialization of Untrusted Data in Infinispan

  It was found that the Hotrod client in Infinispan before 9.2.0.CR1 would unsafely read deserialized data on information from the cache. An authenticated attacker could inject a malicious object into the data cache and attain deserialization on the client, and…

  Infinispan infinispan org.infinispan:infinispan-core Maven
  Feb 15, 2018
• High 8.1
  CVE-2018-5968

  Deserialization of Untrusted Data in jackson-databind

  FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypa…

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Jan 22, 2018
• High 7.5
  CVE-2017-12174

  Uncontrolled Resource Consumption in Artemis and HornetQ

  It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message. This may result in a heap memory exhaustion, full GC, or OutOfMemoryEr…

  Red Hat HornetQ/Artemis org.apache.activemq:artemis-native org.hornetq:hornetq-server Maven
  Mar 7, 2018
• High 7.5
  CVE-2017-7561

  Inconsistent Interpretation of HTTP Requests in Red Hat JBoss EAP

  Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to a server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.

  Red Hat RESTEasy resteasy3.0 resteasy3.0 Debian Ubuntu Maven
  Sep 13, 2017
• High 7.5
  CVE-2018-1048

  Improper Limitation of a Pathname to a Restricted Directory in Jboss EAP Undertow

  It was found that the AJP connector in undertow, as shipped in Jboss EAP 7.1.0.GA, does not use the ALLOW_ENCODED_SLASH option and thus allow the the slash / anti-slash characters encoded in the url which may lead to path traversal and result in the informati…

  Red Hat undertow as shipped in Jboss EAP 7.1.0.GA undertow undertow Debian Ubuntu Maven
  Jan 24, 2018
• Medium 4.8
  CVE-2017-12196

  Incorrect Authorization in Undertow

  undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker t…

  undertow undertow io.undertow:undertow-core Debian Ubuntu Maven
  Apr 18, 2018

Revision history

1. 2026-08-11 #21

   Neue Updates von IBM aufgenommen

2. 2021-02-21 #20

   Neue Updates von HITACHI aufgenommen

3. 2021-02-18 #19

   Neue Updates von Ubuntu aufgenommen

4. 2020-06-15 #18

   Neue Updates von Red Hat aufgenommen

5. 2020-03-02 #17

   Neue Updates von Debian aufgenommen

6. 2020-01-12 #16

   Neue Updates von Juniper aufgenommen

7. 2019-11-14 #15

   Neue Updates von Red Hat aufgenommen

8. 2019-10-20 #14

   Neue Updates von Red Hat aufgenommen

9. 2019-09-26 #13

   Neue Updates von Red Hat aufgenommen

10. 2019-07-16 #12

    Neue Updates von Red Hat aufgenommen

11. 2019-07-15 #11

    Neue Updates von Red Hat aufgenommen

12. 2019-06-04 #10

    Neue Updates von Red Hat aufgenommen

13. 2018-10-16 #9

    New remediations available

14. 2018-08-14 #8

    New remediations available

15. 2018-05-15 #7

    New remediations available

16. 2018-04-23 #5

    New remediations available

17. 2018-04-23 #6

    Version nicht vorhanden

18. 2018-03-25 #4

    New remediations available

19. 2018-03-12 #1

    Initial Release

20. 2018-03-12 #2

    Version nicht vorhanden

21. 2018-03-12 #3

    Version nicht vorhanden

References

• RedHat Security Advisory RHSA-2018:0481 vom 2018-03-12
  https://access.redhat.com/errata/RHSA-2018:0481
• RedHat Security Advisory RHSA-2018:0480 vom 2018-03-12
  https://access.redhat.com/errata/RHSA-2018:0480
• RedHat Security Advisory RHSA-2018:0479 vom 2018-03-12
  https://access.redhat.com/errata/RHSA-2018:0479
• RedHat Security Advisory RHSA-2018:0478 vom 2018-03-12
  https://access.redhat.com/errata/RHSA-2018:0478
• Red Hat Security Advisory RHSA-2018:0576 vom 2018-03-23
  https://access.redhat.com/errata/RHSA-2018:0576
• Red Hat Security Advisory RHSA-2018:0577 vom 2018-03-23
  https://access.redhat.com/errata/RHSA-2018:0577
• NetApp Security Advisory NTAP-20180423-0002 vom 2018-04-24
  https://security.netapp.com/advisory/ntap-20180423-0002/
• Red Hat Security Advisory RHSA-2018:1525 vom 2018-05-16
  https://access.redhat.com/errata/RHSA-2018:1525
• Red Hat Security Advisory RHSA-2018:2405 vom 2018-08-15
  https://access.redhat.com/errata/RHSA-2018:2405
• Red Hat Security Advisory RHSA-2018:2927 vom 2018-10-17
  https://access.redhat.com/errata/RHSA-2018:2927
• Red Hat Security Advisory RHSA-2018:2930 vom 2018-10-17
  https://access.redhat.com/errata/RHSA-2018:2930
• Red Hat Security Advisory RHSA-2019:1326 vom 2019-06-04
  https://access.redhat.com/errata/RHSA-2019:1326
• Red Hat Security Advisory RHSA-2019:1782 vom 2019-07-16
  https://access.redhat.com/errata/RHSA-2019:1782
• Red Hat Security Advisory RHSA-2019:1797 vom 2019-07-16
  https://access.redhat.com/errata/RHSA-2019:1797
• Red Hat Security Advisory RHSA-2019:2858 vom 2019-09-27
  https://access.redhat.com/errata/RHSA-2019:2858
• Red Hat Security Advisory RHSA-2019:3149 vom 2019-10-18
  https://access.redhat.com/errata/RHSA-2019:3149
• Red Hat Security Advisory RHSA-2019:3892 vom 2019-11-14
  https://access.redhat.com/errata/RHSA-2019:3892
• Juniper Security Bulletin
  https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10993
• Debian Security Advisory DLA 2091 vom 2020-03-02
  https://lists.debian.org/debian-lts-announce/2020/debian-lts-announce-202001/msg00037.html
• Red Hat Security Advisory RHSA-2020:2561 vom 2020-06-15
  https://access.redhat.com/errata/RHSA-2020:2561
• Red Hat Security Advisory RHSA-2020:2562 vom 2020-06-15
  https://access.redhat.com/errata/RHSA-2020:2562
• Ubuntu Security Notice USN-4741-1 vom 2021-02-18
  https://ubuntu.com/security/notices/USN-4741-1
• Hitachi Vulnerability Information HITACHI-SEC-2021-110 vom 2021-02-19
  https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2021-110/index.html
• IBM Security Bulletin 7282926 vom 2026-08-11
  https://www.ibm.com/support/pages/node/7282926