RedHat: RHSA-2019-0910:01 Important: Red Hat Fuse 7.3 security update
Summary
This release of Red Hat Fuse 7.3 serves as a replacement for Red Hat Fuse
7.2, and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* jackson-databind: A deserialization flaw was discovered in the
jackson-databind which could allow an unauthenticated user to perform code
execution by sending the maliciously crafted input to the readValue method
of the ObjectMapper. (CVE-2017-7525)
* struts2: ClassLoader manipulation via request parameters (CVE-2014-0112)
* jetty: HTTP request smuggling (CVE-2017-7657)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Summary
Solution
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
Installation instructions are available from the Fuse 7.3.0 product
documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/
References
https://access.redhat.com/security/cve/CVE-2014-0112 https://access.redhat.com/security/cve/CVE-2017-7525 https://access.redhat.com/security/cve/CVE-2017-7657 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.3.0 https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/html-single/release_notes/
Package List
Topic
A minor version update (from 7.2 to 7.3) is now available for Red Hat Fuse.The purpose of this text-only errata is to inform you about the securityissues fixed in this release.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
1091939 - CVE-2014-0112 struts2: ClassLoader manipulation via request parameters1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
1595620 - CVE-2017-7657 jetty: HTTP request smuggling