Red Hat JBoss EAP Component Errors Let Remote Users Deny Service and Remote Authenticated Users Gain Potentially Sensitive Information
SecurityTracker Alert ID: 1041707|
SecurityTracker URL: http://securitytracker.com/id/1041707
(Links to External Site)
Date: Sep 25 2018
Denial of service via network, Disclosure of system information, Disclosure of user information|
Fix Available: Yes Vendor Confirmed: Yes |
Two vulnerabilities were reported in Red Hat JBoss Enterprise Application Platform. A remote user can cause the target service to crash. A remote authenticated user can obtain potentially sensitive information on the target system.|
A remote user can send specially crafted serialized data to trigger an unbounded memory allocation error in the AtomicDoubleArray class and Compound Ordering class of the guava component to cause denial of service conditions [CVE-2018-10237].
A remote authenticated user can send specially crafted data to break the attribute replacement feature in 'picketlink.xml' [CVE-2017-2582].
Hynek Mlnarik (Red Hat) reported one vulnerability.
A remote user can cause the target service to crash.|
A remote authenticated user can obtain potentially sensitive information on the target system.
Red Hat has issued a fix.|
The Red Hat advisory is available at:
Vendor URL: access.redhat.com/errata/RHSA-2018:2740 (Links to External Site)
Access control error, State error|
|Underlying OS: Linux (Red Hat Enterprise)|
This archive entry has one or more follow-up message(s) listed below.|
Source Message Contents
Subject: [RHSA-2018:2740-01] Important: Red Hat JBoss Enterprise Application Platform 6.4.21 security update|
-----BEGIN PGP SIGNED MESSAGE-----
Red Hat Security Advisory
Synopsis: Important: Red Hat JBoss Enterprise Application Platform 6.4.21 security update
Advisory ID: RHSA-2018:2740-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2740
Issue date: 2018-09-24
CVE Names: CVE-2017-2582 CVE-2017-7536 CVE-2018-1336
An update is now available for Red Hat JBoss Enterprise Application
Platform 6.4 for Red Hat Enterprise Linux.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.
This release of Red Hat JBoss Enterprise Application Platform 6.4.21 serves
as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.20,
and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
* hibernate-validator: Privilege escalation when running under the security
* guava: Unbounded memory allocation in AtomicDoubleArray and
CompoundOrdering classes allow remote attackers to cause a denial of
* picketlink: The fix for CVE-2017-2582 breaks the feature of attribute
replacement with system property in picketlink.xml (CVE-2017-2582)
* jbossweb: tomcat: A bug in the UTF-8 decoder can lead to DoS
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
The CVE-2017-2582 issue was discovered by Hynek Mlnarik (Red Hat) and the
CVE-2017-7536 issue was discovered by Gunnar Morling (Red Hat).
Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.
The References section of this erratum contains a download link (you must
log in to download the update).
4. Bugs fixed (https://bugzilla.redhat.com/):
1261190 - [GSS](6.4.z) Upgrade jboss-ejb-client from 1.0.40 to 1.0.41
1410481 - CVE-2017-2582 picketlink, keycloak: SAML request parser replaces special strings with system properties
1465573 - CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
1570200 - [GSS](6.4.z) Upgrade JBoss Modules from 1.3.10 to 1.3.11
1573391 - CVE-2018-10237 guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service
1578830 - (6.4.z) Upgrade hibernate-validator from 4.3.3 to 4.3.4
1580440 - [GSS](6.4.z) Upgrade xnio from 3.0.16 to 3.0.17
1594389 - [GSS](6.4.z) The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml
1602226 - [GSS](6.4.z) Upgrade xerces from 2.9.1.redhat-6 to 2.9.1.redhat-8
1606334 - [GSS](6.4.z) Upgrade JBoss VFS from 3.2.12 to 3.2.13
1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS
1610355 - [GSS](6.4.z) Upgrade HornetQ from 2.3.25.SP24 to 2.3.25.SP28
1610742 - [GSS](6.4.z) Upgrade JBoss Web from 7.5.28 to 7.5.29
1611770 - [GSS](6.4.z) Upgrade Ironjacamar from 1.0.41 to 1.0.42
1614448 - [GSS](6.4.z) Upgrade Jackson from 1.9.9.redhat-6 to 1.9.9.redhat-7
1615347 - [GSS](6.4.z) Upgrade PicketLink from 2.5.4.SP18-redhat-1 to 2.5.4.SP18-redhat-2
1615380 - [GSS](6.4.z) Upgrade Guava from 13.0.1.redhat-2 to 13.0.1.redhat-3
The Red Hat security contact is <email@example.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
-----END PGP SIGNATURE-----
RHSA-announce mailing list