Description
It was discovered that the jboss init script as used in Red Hat JBoss Enterprise Application Platform 7.0.7.GA performed unsafe file handling which could result in local privilege escalation. This issue is a result of an incomplete fix for CVE-2016-8656.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | Red Hat JBoss Enterprise Application Platform | 7.0.7.GA | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 7 | eap7-activemq-artemis +14 | 1.1.0-19.SP24_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-hibernate +5 | 5.0.16-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-ironjacamar +8 | 1.3.8-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-jboss-ec2-eap +1 | 7.0.9-2.GA_redhat_2.ep7.el6 | RHSA-2018:0005 |
| Red Hat JBoss EAP 7 | eap7-jboss-remoting | 4.0.25-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-jboss-xnio-base | 3.4.7-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-jgroups | 3.6.12-1.Final_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-resteasy +17 | 3.0.19-7.SP5_redhat_1.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-undertow | 1.3.31-3.Final_redhat_3.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-wildfly +1 | 7.0.9-4.GA_redhat_3.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
| Red Hat JBoss EAP 7 | eap7-wildfly-javadocs | 7.0.9-2.GA_redhat_3.1.ep7.el6 | RHSA-2018:0004, RHSA-2018:0002 |
Advisories 3
- RHSA-2018:0005 Red Hat Security Advisory: eap7-jboss-ec2-eap security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0002 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 6 Red Hat Security Advisories (RHSA) · Aug 5, 2026
- RHSA-2018:0004 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.0.9 security update on RHEL 7 Red Hat Security Advisories (RHSA) · Aug 5, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12189
- RHSA-2018:0002 vendor-advisory
- RHSA-2018:0004 vendor-advisory
- RHSA-2018:0003 vendor-advisory
- RHSA-2018:0005 vendor-advisory
- 102407 vdb-entry