RedHat: RHSA-2019-0877:01 Important: Red Hat OpenShift Application Runtimes

    Date24 Apr 2019
    CategoryRed Hat
    2695
    Posted ByLinuxSecurity Advisories
    An update is now available for Red Hat OpenShift Application Runtimes. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Important: Red Hat OpenShift Application Runtimes Thorntail 2.4.0 security & bug fix update
    Advisory ID:       RHSA-2019:0877-01
    Product:           Red Hat OpenShift Application Runtimes
    Advisory URL:      https://access.redhat.com/errata/RHSA-2019:0877
    Issue date:        2019-04-24
    CVE Names:         CVE-2018-1067 CVE-2018-1114 CVE-2018-10862 
                       CVE-2018-10894 CVE-2018-10912 CVE-2018-11307 
                       CVE-2018-12022 CVE-2018-12023 CVE-2018-14718 
                       CVE-2018-14719 CVE-2018-19360 CVE-2018-19361 
                       CVE-2018-19362 CVE-2018-1000180 
    =====================================================================
    
    1. Summary:
    
    An update is now available for Red Hat OpenShift Application Runtimes.
    
    Red Hat Product Security has rated this update as having a security impact
    of Important. A Common Vulnerability Scoring System (CVSS) base score,
    which gives a detailed severity rating, is available for each vulnerability
    from the CVE link(s) in the References section.
    
    2. Description:
    
    Red Hat OpenShift Application Runtimes provides an application platform
    that reduces the complexity of developing and operating applications
    (monoliths and microservices) for OpenShift as a containerized platform.
    
    This release of RHOAR Thorntail 2.4.0 serves as a replacement for RHOAR
    Thorntail 2.2.0, and includes security and bug fixes and enhancements. For
    further information, refer to the release notes linked to in the References
    section.
    
    Security Fix(es):
    
    * undertow: HTTP header injection using CRLF with UTF-8 Encoding
    (incomplete fix of CVE-2016-4993) (CVE-2018-1067)
    
    * keycloak: auth permitted with expired certs in SAML client
    (CVE-2018-10894)
    
    * undertow: File descriptor leak caused by
    JarURLConnection.getLastModified() allows attacker to cause a denial of
    service (CVE-2018-1114)
    
    * keycloak: infinite loop in session replacement leading to denial of
    service (CVE-2018-10912)
    
    * wildfly-core: Path traversal can allow the extraction of .war archives to
    write arbitrary files (Zip Slip) (CVE-2018-10862)
    
    * jackson-databind: arbitrary code execution in slf4j-ext class
    (CVE-2018-14718)
    
    * jackson-databind: arbitrary code execution in blaze-ds-opt and
    blaze-ds-core classes (CVE-2018-14719)
    
    * jackson-databind: improper polymorphic deserialization in
    axis2-transport-jms class (CVE-2018-19360)
    
    * jackson-databind: improper polymorphic deserialization in openjpa class
    (CVE-2018-19361)
    
    * jackson-databind: improper polymorphic deserialization in
    jboss-common-core class (CVE-2018-19362)
    
    * jackson-databind: improper polymorphic deserialization of types from
    Oracle JDBC driver (CVE-2018-12023)
    
    * jackson-databind: improper polymorphic deserialization of types from
    Jodd-db library (CVE-2018-12022)
    
    * jackson-databind: Potential information exfiltration with default typing,
    serialization gadget from MyBatis (CVE-2018-11307)
    
    * bouncycastle: flaw in the low-level interface to RSA key pair generator
    (CVE-2018-1000180)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, and other related information, refer to the CVE page(s) listed in
    the References section.
    
    3. Solution:
    
    Before applying the update, back up your existing installation, including
    all applications, configuration files, databases and database settings, and
    so on.
    
    The References section of this erratum contains a download link (you must
    log in to download the update).
    
    4. Bugs fixed (https://bugzilla.redhat.com/):
    
    1550671 - CVE-2018-1067 undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)
    1573045 - CVE-2018-1114 undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service
    1588306 - CVE-2018-1000180 bouncycastle: flaw in the low-level interface to RSA key pair generator
    1593527 - CVE-2018-10862 wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)
    1599434 - CVE-2018-10894 keycloak: auth permitted with expired certs in SAML client
    1607624 - CVE-2018-10912 keycloak: infinite loop in session replacement leading to denial of service
    1666415 - CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class
    1666418 - CVE-2018-14719 jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes
    1666482 - CVE-2018-19360 jackson-databind: improper polymorphic deserialization in axis2-transport-jms class
    1666484 - CVE-2018-19361 jackson-databind: improper polymorphic deserialization in openjpa class
    1666489 - CVE-2018-19362 jackson-databind: improper polymorphic deserialization in jboss-common-core class
    1671096 - CVE-2018-12023 jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver
    1671097 - CVE-2018-12022 jackson-databind: improper polymorphic deserialization of types from Jodd-db library
    1677341 - CVE-2018-11307 jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis
    
    5. References:
    
    https://access.redhat.com/security/cve/CVE-2018-1067
    https://access.redhat.com/security/cve/CVE-2018-1114
    https://access.redhat.com/security/cve/CVE-2018-10862
    https://access.redhat.com/security/cve/CVE-2018-10894
    https://access.redhat.com/security/cve/CVE-2018-10912
    https://access.redhat.com/security/cve/CVE-2018-11307
    https://access.redhat.com/security/cve/CVE-2018-12022
    https://access.redhat.com/security/cve/CVE-2018-12023
    https://access.redhat.com/security/cve/CVE-2018-14718
    https://access.redhat.com/security/cve/CVE-2018-14719
    https://access.redhat.com/security/cve/CVE-2018-19360
    https://access.redhat.com/security/cve/CVE-2018-19361
    https://access.redhat.com/security/cve/CVE-2018-19362
    https://access.redhat.com/security/cve/CVE-2018-1000180
    https://access.redhat.com/security/updates/classification/#important
    https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.thorntail&version=2.4.0
    https://access.redhat.com/documentation/en-us/red_hat_openshift_application_runtimes/1/html-single/rhoar_thorntail_release_notes/
    
    6. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2019 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBXMCvLtzjgjWX9erEAQg89A/7BXw0XUJ42h08r38x4GtqHU40hIoWep2r
    ELZUGzzAacSjR4VBEj3xawCdN+pf2EJoiSF/N9S97PtUCcnLWw6bde1cwS5lAQPI
    lPnPtLOn0I+QutKAhL8pm6Nz2exZCq2N5WHywmWYrwEMmguh3qe4/RLEYl3F+FBC
    7UuztKvvhKOgDebQCGMMbmjZqvimPysyhPwmuQJwVDdbOMQUsWLeKEckCwWvkV93
    hNWdNmtmSnMN85DLZVvRs8D7gINGloXqPHBWwRToz/0ORJXIusLIPyfZgTaaFAkz
    H1Wu7Tq6pYlMUrSQG6heafaodRfBv93Q1JmdVgVPDQeUB0tYNLHIH/60o8ZlWX67
    m+YnB3bDIiEwnwags14BScnwXBxyp0QMRU0xXtJfv5NmZniaUm76KA1oFxKvUVGW
    IIyan4gAemvffvOdM3332N00V9xFQwD5ZG60tv4tTCnJbrMWzPmhcO1OFNk/FKQ6
    7TEOUvBPcktdz5S+xjGEUkWxm65R4e5QTZsjAAa0bDJPmy2+dNEur9d66YIEwChL
    EeCIALrdL7+Sc0omxaDlopxs2ppA+wEamxfwHAkqDoTdqMyZ9fYvZ+SDyiKckAFJ
    xvtqSVnLrsKkaZeG7ZZf/o7Qqujbk8LdqbsoAOKs4C+ruW175Wo5AxecigcE8V0F
    07jIwvgIuVI=
    =Rx36
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    
    You are not authorised to post comments.

    LinuxSecurity Poll

    In your opinion, what is the biggest advantage associated with choosing open-source software/technology?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 4 answer(s).
    /component/communitypolls/?task=poll.vote
    16
    radio
    [{"id":"61","title":"High levels of security","votes":"1","type":"x","order":"1","pct":16.67,"resources":[]},{"id":"62","title":"High levels of quality ","votes":"0","type":"x","order":"2","pct":0,"resources":[]},{"id":"63","title":"Cost-effectiveness ","votes":"0","type":"x","order":"3","pct":0,"resources":[]},{"id":"64","title":"Freedom and flexibility ","votes":"5","type":"x","order":"4","pct":83.33,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.