RedHat: RHSA-2019-3297:01 Important: Red Hat Process Automation Manager

    Date31 Oct 2019
    CategoryRed Hat
    555
    Posted ByLinuxSecurity Advisories
    An update is now available for Red Hat Process Automation Manager. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256
    
    =====================================================================
                       Red Hat Security Advisory
    
    Synopsis:          Important: Red Hat Process Automation Manager 7.5.0 Security Update
    Advisory ID:       RHSA-2019:3297-01
    Product:           Red Hat Process Automation Manager
    Advisory URL:      https://access.redhat.com/errata/RHSA-2019:3297
    Issue date:        2019-10-31
    CVE Names:         CVE-2019-12384 CVE-2019-12814 CVE-2019-14379 
    =====================================================================
    
    1. Summary:
    
    An update is now available for Red Hat Process Automation Manager.
    
    Red Hat Product Security has rated this update as having a security impact
    of Important. A Common Vulnerability Scoring System (CVSS) base score,
    which gives a detailed severity rating, is available for each vulnerability
    from the CVE link(s) in the References section.
    
    2. Description:
    
    Red Hat Process Automation Manager is an open source business process
    management suite that combines process management and decision service
    management and enables business and IT users to create, manage, validate,
    and deploy process applications and decision services.
    
    This release of Red Hat Process Automation Manager 7.5.0 serves as an
    update to Red Hat Process Automation Manager 7.4.1, and includes bug fixes
    and enhancements, which are documented in the Release Notes document linked
    to in the References.
    
    Security Fix(es):
    
    * jackson-databind: default typing mishandling leading to remote code
    execution (CVE-2019-14379)
    
    * jackson-databind: failure to block the logback-core class from
    polymorphic deserialization leading to remote code execution
    (CVE-2019-12384)
    
    * jackson-databind: polymorphic typing issue allows attacker to read
    arbitrary local files on the server via crafted JSON message
    (CVE-2019-12814)
    
    For more details about the security issue(s), including the impact, a CVSS
    score, and other related information, refer to the CVE page(s) listed in
    the References section.
    
    3. Solution:
    
    For on-premise installations, before applying the update, back up your
    existing installation, including all applications, configuration files,
    databases and database settings, and so on.
    
    It is recommended to halt the server by stopping the JBoss Application
    Server process before installing this update; after installing the update,
    restart the server by starting the JBoss Application Server process.
    
    The References section of this erratum contains a download link (you must
    log in to download the update).
    
    4. Bugs fixed (https://bugzilla.redhat.com/):
    
    1725795 - CVE-2019-12814 jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message.
    1725807 - CVE-2019-12384 jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution
    1737517 - CVE-2019-14379 jackson-databind: default typing mishandling leading to remote code execution
    
    5. References:
    
    https://access.redhat.com/security/cve/CVE-2019-12384
    https://access.redhat.com/security/cve/CVE-2019-12814
    https://access.redhat.com/security/cve/CVE-2019-14379
    https://access.redhat.com/security/updates/classification/#important
    https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=rhpam&version=7.5.0
    https://access.redhat.com/documentation/en-us/red_hat_process_automation_manager/7.5/html/release_notes_for_red_hat_process_automation_manager_7.5/index
    
    6. Contact:
    
    The Red Hat security contact is . More contact
    details at https://access.redhat.com/security/team/contact/
    
    Copyright 2019 Red Hat, Inc.
    -----BEGIN PGP SIGNATURE-----
    Version: GnuPG v1
    
    iQIVAwUBXbsxydzjgjWX9erEAQjL/w//fUGV9b+nAlG7dg5GK07uBp4XG6+1hoVL
    X8hCpFY7WudqJjDPHtKqDE6BbGC/qMFnYSoVRbZYF3XZAS04mfVS/KfMoVNxoAUR
    VqZB6wzsmRP9Ty9CTCGJ2l6bZH51MEH4meflwDtmCS5YmZvhtwl0ZDPZQ/3lL0Jn
    Z4QxtDhPW36Oy2/2CvHQeIau1tN0add5geqd+w+n+EMtuspMFUOA3DhPZ41CgrD6
    nVE/v1YMEAR/7fe85z7q3vKEd02E5Ax5w4bhSqQNKbVbmU5xcCaj1Ea5160t4PVj
    wsNuR6pNcgW/fUbFWjWkcy1XVe2X/OO5uyNSU6m0Qc9OIgcfaTn3GDFaCQhnkxNL
    L1E+yiWgt0qvwqbGyI9CTBulu+okW4iacgU2h5s86RIvFG58/uWMwoCSCfVlWmDJ
    RFvoxyKC9C97K/xwelH+/NzxkUvCYlS6ZESOQRm/4p88wUKkXxyN0rez1I/ADKsW
    7C2BKSJZM6Cg/jmPCxMXqUfHZbvhpgolTAqJHcJoBvRDOY4jPWUPDRjJ4kK4UF7Q
    LxTa82AuWIfGhBOX86uUi+rgqygR2trJKN1FUM8pNrhGGbaG1l1VcC2WvjD3LfCI
    l8YytCZT6NQ1/aOlqIO5Eth8xoNcKFA0jFWqWzF9lPxhq64cpAcr8ufHLWcrMKcu
    GKsrw+GwWfE=
    =5hwz
    -----END PGP SIGNATURE-----
    
    --
    RHSA-announce mailing list
    This email address is being protected from spambots. You need JavaScript enabled to view it.
    https://www.redhat.com/mailman/listinfo/rhsa-announce
    
    
    You are not authorised to post comments.

    Comments powered by CComment

    LinuxSecurity Poll

    What do you think of the articles on LinuxSecurity?

    No answer selected. Please try again.
    Please select either existing option or enter your own, however not both.
    Please select minimum 0 answer(s) and maximum 3 answer(s).
    /main-polls/24-what-do-you-think-of-the-quality-of-the-articles-on-linuxsecurity?task=poll.vote&format=json
    24
    radio
    [{"id":"87","title":"Excellent, don't change a thing!","votes":"65","type":"x","order":"1","pct":57.52,"resources":[]},{"id":"88","title":"Should be more technical","votes":"15","type":"x","order":"2","pct":13.27,"resources":[]},{"id":"89","title":"Should include more HOWTOs","votes":"33","type":"x","order":"3","pct":29.2,"resources":[]}]["#ff5b00","#4ac0f2","#b80028","#eef66c","#60bb22","#b96a9a","#62c2cc"]["rgba(255,91,0,0.7)","rgba(74,192,242,0.7)","rgba(184,0,40,0.7)","rgba(238,246,108,0.7)","rgba(96,187,34,0.7)","rgba(185,106,154,0.7)","rgba(98,194,204,0.7)"]350
    bottom200

    We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.