Stay Secure with the Latest Linux Advisories

security advisoryred hatsecurity fix

Red Hat: RHSA-2018:2277 Critical: JBoss Enterprise Application Security

A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score,. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Application Platform 7.1 security update Advisory ID: RHSA-2018:2277-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2018:2277 Issue date: 2018-07-26 CVE Names: CVE-2018-8039 CVE-2018-10862 ==================================================================== 1. Summary: A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on Wildfly. This asynchronous patch is a security update for apache-cxf package in Red Hat JBoss Enterprise Application Platform 7.1 Security Fix(es): * apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039) * wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files. (CVE-2018-10862) 3. Solution: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). The JBoss server process must be restarted for the update to takeeffect. 4. Bugs fixed (https://bugzilla.redhat.com/): 1593527 - CVE-2018-10862 wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip) 1595332 - CVE-2018-8039 apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* 5. References: https://access.redhat.com/security/cve/CVE-2018-8039 https://access.redhat.com/security/cve/CVE-2018-10862 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.1 https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/?version=7.1/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW1nrWNzjgjWX9erEAQhmSBAAk5RFwnwbvUL2KTI9b70b71c4qCUcD6jm ulrJ9g497frFESgQ2/9Ddybo8hGpcU+f8yhK2Q1NBu7Vol2XY8YDlphwa/ItZypO KglcHw0VQAT1St0OHIaoea8D2+DpygMPZz/fMHnj2zgN7lI21ux9Hs6nYNnu1Ji7 CEj1NHU48MFnMeHD5NmzvZpTSt4yigC0dPX0TO83GJMx4p26MFfgocwTSN8uIML3 K5f76OTEQ+/N41BgzLED3DwJqkJNhU7zNOFX02UKcjctNsnDYi0yc+/juPs7ZPi5 N/baKyb9neYRI9Lj+D8jR3AsUsnIYKKNsKUotI39LXpVZGf90y92ESLSi+g4Drnc XUGK+GkLoi++98gBuASJn7Ds22BCVFvYaSOjTAG4Pe56c5FTfJrpPSpIAuTR4Yub nOSJmSMgxEdJ9PgwnAoms2LCCi8ynRgZeTwI2lsDD1jI9gUSAhYOn8ub2Dbxdd/g 0Esc6Hj44EkwTrMQsnlpjlZBd27PAqCWbnxV/MaMK1lbqYC7tJ448y+26yVHJpP6 SRGCqtwCR5bKDHxOPRVMb3z3UR73TZUq+i4WadgkEpN4aZDz0Zp/VMCEFT6udRf0 wB8saye2rkJZz3yxQYU938clG46q3m6/xZG620gnJvaBnLRnAWgS1tXE3n8jXg+2 wzkxB000Sx8=c+Wv -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . Crucial patch release for Red Hat JBoss Enterprise Application fixes severe vulnerabilities. Safeguard your system immediately!. Red Hat JBoss, Security Update, Enterprise Application, TLS Verification, Path Traversal. . Severity: Important. LinuxSecurity.com Team

Jul 26, 2018 •Important Red Hat