Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 573
Alerts This Week
Warning Icon 1 573

Red Hat Fuse 7.2 RHSA-2018-3768-01 Important Security Advisory

red hat
Calendar Grey December 4, 2018
Dist Redhat Esm H88
A critical software patch has been released for Red Hat Fuse 7.2, resolving various security vulnerabilities and operational glitches.
An update is now available for Red Hat Fuse

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are located in the download section of the customer portal.

The References section of this erratum contains a download link (you must log in to download the update).

Summary

Red Hat Fuse enables integration experts, application developers, and business users to collaborate and independently develop connected solutions.
Fuse is part of an agile integration solution. Its distributed approach allows teams to deploy integrated services where required. The API-centric, container-based architecture decouples services so they can be created, extended, and deployed independently.
This release of Red Hat Fuse 7.2 serves as a replacement for Red Hat Fuse 7.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.
Security Fix(es):
* xmlrpc: Deserialization of untrusted Java object through tag (CVE-2016-5003)
* tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336)
* ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint (CVE-2018-8018)
* apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)
* xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)
* undertow: Client can use bogus uri in Digest authentication (CVE-2017-12196)
* spring-data-commons: XXE with Spring Data’s XMLBeam integration (CVE-2018-1259)
* kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass (CVE-2018-1288)
* tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)
* camel-mail: path traversal vulnerability (CVE-2018-8041)
* vertx: Improper neutralization of CRLF sequences allows remote attackersto inject arbitrary HTTP response headers (CVE-2018-12537)
* spring-framework: ReDoS Attack with spring-messaging (CVE-2018-1257)
For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.
Red Hat would like to thank Eedo Shapira (GE Digital) for reporting CVE-2018-8041. The CVE-2017-12196 issue was discovered by Jan Stourac (Red Hat).

Topics%20covered

Topics Covered

security advisory security update integration security impact DoS fix Red Hat Fuse

References

https://access.redhat.com/security/cve/CVE-2016-5002 https://access.redhat.com/security/cve/CVE-2016-5003 https://access.redhat.com/security/cve/CVE-2017-12196 https://access.redhat.com/security/cve/CVE-2018-1257 https://access.redhat.com/security/cve/CVE-2018-1259 https://access.redhat.com/security/cve/CVE-2018-1288 https://access.redhat.com/security/cve/CVE-2018-1336 https://access.redhat.com/security/cve/CVE-2018-8014 https://access.redhat.com/security/cve/CVE-2018-8018 https://access.redhat.com/security/cve/CVE-2018-8039 https://access.redhat.com/security/cve/CVE-2018-8041 https://access.redhat.com/security/cve/CVE-2018-12537 https://access.redhat.com/security/updates/classification#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=distributions&version=7.2.0 / https://access.redhat.com/articles/2939351

Package List


Severity
important
Lowest
Low
Medium
High
Critical

Advisory ID: RHSA-2018:3768-01
Product: Red Hat JBoss Fuse
Advisory URL: https://access.redhat.com/errata/RHSA-2018:3768
Issue date: 2018-12-04

Topic

An update is now available for Red Hat Fuse.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory security update integration security impact DoS fix Red Hat Fuse

Relevant Releases Architectures

Bugs Fixed

1503055 - CVE-2017-12196 undertow: Client can use bogus uri in Digest authentication

1508110 - CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD

1508123 - CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through tag

1578578 - CVE-2018-1257 spring-framework: ReDoS Attack with spring-messaging

1578902 - CVE-2018-1259 spring-data-commons: XXE with Spring Data’s XMLBeam integration

1579611 - CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins

1591072 - CVE-2018-12537 vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers1595332 - CVE-2018-8039 apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*

1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS

1607731 - CVE-2018-8018 ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint

1611059 - CVE-2018-1288 kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass

1612644 - CVE-2018-8041 camel-mail: path traversal vulnerability

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.