Alerts This Week
Warning Icon 1 692
Alerts This Week
Warning Icon 1 692

Red Hat: RHSA-2018-2939-01 Critical: Remote Code Execution Threat

red hat
Calendar Grey October 17, 2018
Dist Redhat Esm H88
Canonical released an important notification regarding Ubuntu 20.04, addressing multiple vulnerabilities such as privilege escalation and Denial of Service.
An update is now available for Red Hat Fuse Integration Services

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Updating instructions and release notes may be found at:

https://access.redhat.com/articles/3060411

Summary

Red Hat Fuse Integration Services provides a set of tools and containerized xPaaS images that enable development, deployment, and management of integration microservices within OpenShift.
Security fix(es):
* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489)
* spring-framework: Address partial fix for CVE-2018-1270 (CVE-2018-1275)
* spring-framework: Directory traversal vulnerability with static resources on Windows filesystems (CVE-2018-1271)
* spring-framework: Possible RCE via spring messaging (CVE-2018-1270)
* spring-security-oauth: remote code execution in the authorization process (CVE-2018-1260)
* tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336)
* tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)
* tomcat: Late application of security constraints can lead to resource exposure for unauthorised users (CVE-2018-1305)
* tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Topics%20covered

Topics Covered

security advisory critical remote code execution DoS security fix Red Hat Fuse integration services

References

https://access.redhat.com/security/cve/CVE-2017-12617 https://access.redhat.com/security/cve/CVE-2018-1260 https://access.redhat.com/security/cve/CVE-2018-1270 https://access.redhat.com/security/cve/CVE-2018-1271 https://access.redhat.com/security/cve/CVE-2018-1275 https://access.redhat.com/security/cve/CVE-2018-1304 https://access.redhat.com/security/cve/CVE-2018-1305 https://access.redhat.com/security/cve/CVE-2018-1336 https://access.redhat.com/security/cve/CVE-2018-7489 https://access.redhat.com/security/updates/classification#critical

Package List


Severity
critical
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2018:2939-01
Product: Red Hat JBoss Fuse
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2939
Issue date: 2018-10-17

Topic

An update is now available for Red Hat Fuse Integration Services.Red Hat Product Security has rated this update as having a security impactof Critical. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory critical remote code execution DoS security fix Red Hat Fuse integration services

Relevant Releases Architectures

Bugs Fixed

1494283 - CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615

1548282 - CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users1548289 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources

1549276 - CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries

1564405 - CVE-2018-1270 spring-framework: Possible RCE via spring messaging

1565307 - CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270

1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems

1584376 - CVE-2018-1260 spring-security-oauth: remote code execution in the authorization process

1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here