RedHat: RHSA-2020-2067:01 Important: Red Hat build of Thorntail 2.5.1
Summary
This release of Red Hat build of Thorntail 2.5.1 includes security updates,
bug fixes, and enhancements. For more information, see the release notes
page listed in the References section.
Security Fix(es):
* apache-commons-beanutils: does not suppresses the class property in
PropertyUtilsBean by default (CVE-2019-10086)
* cxf: does not restrict the number of message attachments (CVE-2019-12406)
* cxf: OpenId Connect token service does not properly validate the clientId
(CVE-2019-12419)
* hibernate-validator: safeHTML validator allows XSS (CVE-2019-10219)
* HTTP/2: flood using PING frames results in unbounded memory growth
(CVE-2019-9512)
* HTTP/2: flood using HEADERS frames results in unbounded memory growth
(CVE-2019-9514)
* HTTP/2: flood using SETTINGS frames results in unbounded memory growth
(CVE-2019-9515)
* HTTP/2: large amount of data requests leads to denial of service
(CVE-2019-9511)
* jackson-databind: Multiple serialization gadgets (CVE-2019-17531,
CVE-2019-16943, CVE-2019-16942, CVE-2019-17267, CVE-2019-14540,
CVE-2019-16335, CVE-2019-14893, CVE-2019-14892, CVE-2020-9546,
CVE-2020-9547, CVE-2020-9548, CVE-2020-10969, CVE-2020-10968,
CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619,
CVE-2020-11620, CVE-2019-20330, CVE-2020-8840)
* jackson-databind: mishandles the interaction between serialization
gadgets and typing which could result in remote command
execution (CVE-2020-10672, CVE-2020-10673)
* keycloak: adapter endpoints are exposed via arbitrary URLs
(CVE-2019-14820)
* keycloak: missing signatures validation on CRL used to verify client
certificates (CVE-2019-3875)
* keycloak: SAML broker does not check existence of signature on document
allowing any user impersonation (CVE-2019-10201)
* keycloak: CSRF check missing in My Resources functionality in the Account
Console (CVE-2019-10199)
* keycloak: cross-realm user access auth bypass (CVE-2019-14832)
* netty: HTTP Request Smuggling due to Transfer-Encoding whitespace
mishandling (CVE-2020-7238)
* SmallRye: SecuritySupport class is incorrectly public and contains a
static method to access the current threads context class loader
(CVE-2020-1729)
* thrift: Out-of-bounds read related to TJSONProtocol or
TSimpleJSONProtocol (CVE-2019-0210)
* thrift: Endless loop when feed with specific input data (CVE-2019-0205)
* undertow: possible Denial Of Service (DOS) in Undertow HTTP server
listening on HTTPS (CVE-2019-14888)
* wildfly: The 'enabled-protocols' value in legacy security is not
respected if OpenSSL security provider is in use (CVE-2019-14887)
* wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and
'Deployer' user by default (CVE-2019-14838)
* xml-security: Apache Santuario potentially loads XML parsing code from an
untrusted source (CVE-2019-12400)
For more details about the security issues and their impact, the CVSS
score, acknowledgements, and other related information, see the CVE pages
listed in the References section.
Summary
Solution
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
The References section of this erratum contains a download link for the
update. You must be logged in to download the update.
References
https://access.redhat.com/security/cve/CVE-2019-0205 https://access.redhat.com/security/cve/CVE-2019-0210 https://access.redhat.com/security/cve/CVE-2019-3875 https://access.redhat.com/security/cve/CVE-2019-9511 https://access.redhat.com/security/cve/CVE-2019-9512 https://access.redhat.com/security/cve/CVE-2019-9514 https://access.redhat.com/security/cve/CVE-2019-9515 https://access.redhat.com/security/cve/CVE-2019-10086 https://access.redhat.com/security/cve/CVE-2019-10199 https://access.redhat.com/security/cve/CVE-2019-10201 https://access.redhat.com/security/cve/CVE-2019-10219 https://access.redhat.com/security/cve/CVE-2019-12400 https://access.redhat.com/security/cve/CVE-2019-12406 https://access.redhat.com/security/cve/CVE-2019-12419 https://access.redhat.com/security/cve/CVE-2019-14540 https://access.redhat.com/security/cve/CVE-2019-14820 https://access.redhat.com/security/cve/CVE-2019-14832 https://access.redhat.com/security/cve/CVE-2019-14838 https://access.redhat.com/security/cve/CVE-2019-14887 https://access.redhat.com/security/cve/CVE-2019-14888 https://access.redhat.com/security/cve/CVE-2019-14892 https://access.redhat.com/security/cve/CVE-2019-14893 https://access.redhat.com/security/cve/CVE-2019-16335 https://access.redhat.com/security/cve/CVE-2019-16942 https://access.redhat.com/security/cve/CVE-2019-16943 https://access.redhat.com/security/cve/CVE-2019-17267 https://access.redhat.com/security/cve/CVE-2019-17531 https://access.redhat.com/security/cve/CVE-2019-20330 https://access.redhat.com/security/cve/CVE-2020-1729 https://access.redhat.com/security/cve/CVE-2020-7238 https://access.redhat.com/security/cve/CVE-2020-8840 https://access.redhat.com/security/cve/CVE-2020-9546 https://access.redhat.com/security/cve/CVE-2020-9547 https://access.redhat.com/security/cve/CVE-2020-9548 https://access.redhat.com/security/cve/CVE-2020-10672 https://access.redhat.com/security/cve/CVE-2020-10673 https://access.redhat.com/security/cve/CVE-2020-10968 https://access.redhat.com/security/cve/CVE-2020-10969 https://access.redhat.com/security/cve/CVE-2020-11111 https://access.redhat.com/security/cve/CVE-2020-11112 https://access.redhat.com/security/cve/CVE-2020-11113 https://access.redhat.com/security/cve/CVE-2020-11619 https://access.redhat.com/security/cve/CVE-2020-11620 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.thorntail&version=2.5.1 https://access.redhat.com/documentation/en-us/red_hat_build_of_thorntail/2.5/html/release_notes_for_thorntail_2.5/
Package List
Topic
An update is now available for Red Hat build of Thorntail.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for eachvulnerability. For more information, see the CVE links in the Referencessection.
Topic
Relevant Releases Architectures
Bugs Fixed
1649870 - CVE-2019-14820 keycloak: adapter endpoints are exposed via arbitrary URLs
1690628 - CVE-2019-3875 keycloak: missing signatures validation on CRL used to verify client certificates
1728609 - CVE-2019-10201 keycloak: SAML broker does not check existence of signature on document allowing any user impersonation
1729261 - CVE-2019-10199 keycloak: CSRF check missing in My Resources functionality in the Account Console
1735645 - CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth
1735744 - CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth
1735745 - CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth
1738673 - CVE-2019-10219 hibernate-validator: safeHTML validator allows XSS
1741860 - CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service
1749487 - CVE-2019-14832 keycloak: cross-realm user access auth bypass
1751227 - CVE-2019-14838 wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default
1755831 - CVE-2019-16335 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource
1755849 - CVE-2019-14540 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig
1758167 - CVE-2019-17267 jackson-databind: Serialization gadgets in classes of the ehcache package
1758171 - CVE-2019-14892 jackson-databind: Serialization gadgets in classes of the commons-configuration package
1758182 - CVE-2019-14893 jackson-databind: Serialization gadgets in classes of the xalan package
1758187 - CVE-2019-16942 jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*
1758191 - CVE-2019-16943 jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource
1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol
1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data
1764658 - CVE-2019-12400 xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source
1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default
1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
1772464 - CVE-2019-14888 undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS
1775293 - CVE-2019-17531 jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*
1793154 - CVE-2019-20330 jackson-databind: lacks certain net.sf.ehcache blocking
1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling
1802444 - CVE-2020-1729 SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader
1815470 - CVE-2020-10673 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution
1815495 - CVE-2020-10672 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution
1816170 - CVE-2019-12406 cxf: does not restrict the number of message attachments
1816175 - CVE-2019-12419 cxf: OpenId Connect token service does not properly validate the clientId
1816330 - CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking
1816332 - CVE-2020-9546 jackson-databind: Serialization gadgets in shaded-hikari-config
1816337 - CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap
1816340 - CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core
1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider
1819212 - CVE-2020-10969 jackson-databind: Serialization gadgets in javax.swing.JEditorPane
1821304 - CVE-2020-11111 jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory
1821311 - CVE-2020-11112 jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider
1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime
1826798 - CVE-2020-11620 jackson-databind: Serialization gadgets in commons-jelly:commons-jelly
1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop
