SecurityTracker.com
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 


Category:   Application (Web Server/CGI)  >   Red Hat JBoss Vendors:   Red Hat
Red Hat JBoss EAP Component Errors Let Remote Users Deny Service and Remote Authenticated Users Gain Potentially Sensitive Information
SecurityTracker Alert ID:  1041707
SecurityTracker URL:  http://securitytracker.com/id/1041707
CVE Reference:   CVE-2017-2582, CVE-2018-10237   (Links to External Site)
Date:  Sep 25 2018
Impact:   Denial of service via network, Disclosure of system information, Disclosure of user information
Fix Available:  Yes  Vendor Confirmed:  Yes  

Description:   Two vulnerabilities were reported in Red Hat JBoss Enterprise Application Platform. A remote user can cause the target service to crash. A remote authenticated user can obtain potentially sensitive information on the target system.

A remote user can send specially crafted serialized data to trigger an unbounded memory allocation error in the AtomicDoubleArray class and Compound Ordering class of the guava component to cause denial of service conditions [CVE-2018-10237].

A remote authenticated user can send specially crafted data to break the attribute replacement feature in 'picketlink.xml' [CVE-2017-2582].

Hynek Mlnarik (Red Hat) reported one vulnerability.

Impact:   A remote user can cause the target service to crash.

A remote authenticated user can obtain potentially sensitive information on the target system.

Solution:   Red Hat has issued a fix.

The Red Hat advisory is available at:

https://access.redhat.com/errata/RHSA-2018:2740
https://access.redhat.com/errata/RHSA-2018:2741
https://access.redhat.com/errata/RHSA-2018:2742
https://access.redhat.com/errata/RHSA-2018:2743

Vendor URL:  access.redhat.com/errata/RHSA-2018:2740 (Links to External Site)
Cause:   Access control error, State error
Underlying OS:  Linux (Red Hat Enterprise)

Message History:   This archive entry has one or more follow-up message(s) listed below.
Oct 16 2018 (Red Hat Issues Fix for Red Hat Network Satellite Server) Red Hat JBoss EAP Component Errors Let Remote Users Deny Service and Remote Authenticated Users Gain Potentially Sensitive Information
Red Hat has issued a fix for Red Hat Network Satellite Server for Red Hat Enterprise Linux.



 Source Message Contents

Subject:  [RHSA-2018:2740-01] Important: Red Hat JBoss Enterprise Application Platform 6.4.21 security update

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Enterprise Application Platform 6.4.21 security update
Advisory ID:       RHSA-2018:2740-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2740
Issue date:        2018-09-24
CVE Names:         CVE-2017-2582 CVE-2017-7536 CVE-2018-1336 
                   CVE-2018-10237 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Enterprise Application
Platform 6.4 for Red Hat Enterprise Linux.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.

This release of Red Hat JBoss Enterprise Application Platform 6.4.21 serves
as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.20,
and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.

Security Fix(es):

* hibernate-validator: Privilege escalation when running under the security
manager (CVE-2017-7536)

* guava: Unbounded memory allocation in AtomicDoubleArray and
CompoundOrdering classes allow remote attackers to cause a denial of
service (CVE-2018-10237)

* picketlink: The fix for CVE-2017-2582 breaks the feature of attribute
replacement with system property in picketlink.xml (CVE-2017-2582)

* jbossweb: tomcat: A bug in the UTF-8 decoder can lead to DoS
(CVE-2018-1336)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

The CVE-2017-2582 issue was discovered by Hynek Mlnarik (Red Hat) and the
CVE-2017-7536 issue was discovered by Gunnar Morling (Red Hat).

3. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1261190 - [GSS](6.4.z) Upgrade jboss-ejb-client from 1.0.40 to 1.0.41
1410481 - CVE-2017-2582 picketlink, keycloak: SAML request parser replaces special strings with system properties
1465573 - CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
1570200 - [GSS](6.4.z) Upgrade JBoss Modules from 1.3.10 to 1.3.11
1573391 - CVE-2018-10237 guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service
1578830 - (6.4.z) Upgrade hibernate-validator from 4.3.3 to 4.3.4
1580440 - [GSS](6.4.z) Upgrade xnio from 3.0.16 to 3.0.17
1594389 - [GSS](6.4.z) The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml
1602226 - [GSS](6.4.z) Upgrade xerces from 2.9.1.redhat-6 to 2.9.1.redhat-8
1606334 - [GSS](6.4.z) Upgrade JBoss VFS from 3.2.12 to 3.2.13
1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS
1610355 - [GSS](6.4.z) Upgrade HornetQ from 2.3.25.SP24 to 2.3.25.SP28
1610742 - [GSS](6.4.z) Upgrade JBoss Web from 7.5.28 to 7.5.29
1611770 - [GSS](6.4.z) Upgrade Ironjacamar from 1.0.41 to 1.0.42
1614448 - [GSS](6.4.z) Upgrade Jackson from 1.9.9.redhat-6 to 1.9.9.redhat-7
1615347 - [GSS](6.4.z) Upgrade PicketLink from 2.5.4.SP18-redhat-1 to 2.5.4.SP18-redhat-2
1615380 - [GSS](6.4.z) Upgrade Guava from 13.0.1.redhat-2 to 13.0.1.redhat-3

5. References:

https://access.redhat.com/security/cve/CVE-2017-2582
https://access.redhat.com/security/cve/CVE-2017-7536
https://access.redhat.com/security/cve/CVE-2018-1336
https://access.redhat.com/security/cve/CVE-2018-10237
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/6.4/
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW6lbXtzjgjWX9erEAQgvuhAAmWjRjX6+cckdgzHrBqY86ABFz+T6rvhW
xKr+NPFA32mvWqSTs5Faasvp4E360/j1b3SGKb7xw9zeMubbyc8a0qdOyszxQ9VU
UcUgU0Yd5qOdipaqEKtKQIKwTR/px4Vx8PuFLoDfQ9VcTTCUS7061G6FBwmTD6Ur
iN2UMxIicJwORdTpcmLJyWWSzM5fXFlgua6cP3ybfZ3BJz1XfmBhVu4uXAZJbsdt
6MCslgIloWAhTo4CS/Wbnl0LTFrUrKxsNMCwRV8ZvtyYpBSiAh9R/dMtippcKfuN
AaEyvK1HYFe0tEvMXVgHullihFXS3+E9EhGhfYueuZCwcLmSk/Yk1/r2II7Ci1FX
ZnUTNxaK7FMXivFl5ln8m82B+icFEzdvZg61P8ARs6lRZTveVJ8j14AijtUPh+RL
ePPF+o1MKDZDavWXz7gv8B4cYFdmu3ZnyZAWt+OcGfdJ0AafitnlRbxhIjOrMT9/
HQUfLULPMsG5WKmAOezKsrwDEAtQ27TBeoB0kDz2eJoFYOJ2ebtJpy87D6Omc+zF
hT1IDlGJfCc4x79GlEcShzJrCF8k6kpXzEPbqj/jQmPRV0pwK8yP7Ji1PTZmjXM4
WadUl98BuLTTh5wiF18Am3ag9cWuhCA6x1BCV9teTJiLBilYwOGHW2Pi+pSM8krT
VJ9QX/0XtOQ=
=Kz1/
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2019, SecurityGlobal.net LLC