RedHat: RHSA-2020-2561:01 Critical: EAP Continuous Delivery Technical
Summary
Red Hat JBoss Enterprise Application Platform CD12 is a platform for Java
applications based on the WildFly application runtime.
This release of Red Hat JBoss Enterprise Application Platform CD12 includes
bug fixes and enhancements.
Security Fix(es):
* artemis: artemis/hornetq: memory exhaustion via UDP and JGroups discovery
(CVE-2017-12174)
* lucene: Solr: Code execution via entity expansion (CVE-2017-12629)
* infinispan-core: infinispan: Unsafe deserialization of malicious object
injected into data cache (CVE-2017-15089)
* slf4j: Deserialisation vulnerability in EventData constructor can allow
for arbitrary code execution (CVE-2018-8088)
* elytron: client can use bogus uri in digest authentication
(CVE-2017-12196)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Summary
Solution
Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.
You must restart the JBoss server process for the update to take effect.
The References section of this erratum contains a download link (you must
log in to download the update)
References
https://access.redhat.com/security/cve/CVE-2017-12174 https://access.redhat.com/security/cve/CVE-2017-12196 https://access.redhat.com/security/cve/CVE-2017-12629 https://access.redhat.com/security/cve/CVE-2017-15089 https://access.redhat.com/security/cve/CVE-2018-8088 https://access.redhat.com/security/updates/classification/#critical
Package List
Topic
This is a security update for JBoss EAP Continuous Delivery 12.0.Red Hat Product Security has rated this update as having a security impactof Critical. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
1498378 - CVE-2017-12174 artemis/hornetq: memory exhaustion via UDP and JGroups discovery
1501529 - CVE-2017-12629 Solr: Code execution via entity expansion
1503055 - CVE-2017-12196 undertow: Client can use bogus uri in Digest authentication
1503610 - CVE-2017-15089 infinispan: Unsafe deserialization of malicious object injected into data cache
1548909 - CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution
