Executive Summary

Summary
Title Red Hat JBoss Enterprise Application Platform 7.2.0 security update
Informations
Name RHSA-2019:0139 First vendor Publication 2019-01-22
Vendor RedHat Last vendor Modification 2019-01-22
Severity (Vendor) N/A Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:S/C:P/I:N/A:N)
Cvss Base Score 4 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Low
Cvss Expoit Score 8 Authentication Requires single instance
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

Red Hat JBoss Enterprise Application Platform 7.2.0 is now available.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.0 Release Notes for information on the most significant bug fixes and enhancements included in this release.

Security Fix(es):

* picketlink: SAML request parser replaces special strings with system properties (CVE-2017-2582)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

The CVE-2017-2582 issue was discovered by Hynek Mlnarik (Red Hat).

3. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must log in to download the update).

The JBoss server process must be restarted for the update to take effect.

4. Bugs fixed (https://bugzilla.redhat.com/):

1410481 - CVE-2017-2582 picketlink, keycloak: SAML request parser replaces special strings with system properties

5. JIRA issues fixed (https://issues.jboss.org/):

JBEAP-12932 - Upgrade WildFly Core to 4.0.1.Final JBEAP-13189 - Upgrade Generic JMS RA 2.0.1.Final JBEAP-13658 - Upgrade JGroups to 3.6.15.Final JBEAP-13867 - [Artemis upgrade] Transformer interface was changed JBEAP-13895 - [GSS](7.2.0) Upgrade picketlink from 2.5.5.SP8 to 2.5.5.SP9 JBEAP-14222 - (EL12) Upgrade Infinispan to 9.1.6.Final to 9.1.7.Final JBEAP-14239 - (EL12) Upgrade Artemis to 1.5.5.009-redhat-1 JBEAP-14386 - (7.2.0.EO12) Upgrade slf4j from 1.7.22.redhat-1 to 1.7.22.redhat-2 JBEAP-14415 - Upgrade WildFly Core to 4.0.1.Final-redhat-1 JBEAP-14421 - Upgrade WildFly Elytron Tool to 1.1.4.Final JBEAP-14422 - Upgrade WildFly Elytron to 1.2.4.Final JBEAP-14427 - Upgrade Undertow to 2.0.0.SP1 JBEAP-14504 - Upgrade WildFly HTTP client 1.0.12.Final JBEAP-14581 - (CD12) Upgrade FasterXML Jackson from 2.9.4.redhat-1 to 2.9.5.redhat-1 JBEAP-14811 - 7.2 - Migration Guide: Upgrade org.apache.santuario.xmlsec to 2.1.1. caused regression in PicketLinkSTS JBEAP-14852 - Upgrade to Galleon 1.0.1.Final and Galleon Plugins 1.0.1.Final (core) JBEAP-14853 - Upgrade to Galleon 1.0.1.Final and Galleon Plugins 1.0.1.Final (full) JBEAP-14854 - [7.2] Migration Guide: document upgrade from Hibernate ORM 5.1 to 5.3 JBEAP-14881 - Upgrade PicketBox to 5.0.3.Final JBEAP-15030 - [CD14] Clarify wording on EJB timers before upgrade/migration JBEAP-15044 - Upgrade to Apache CXF from 3.2.4 to 3.2.5 JBEAP-15046 - Upgrade to Apache CXF 3.2.5 JBEAP-15069 - Installer: Upgrade IzPack aesh-readline to 1.10 JBEAP-15123 - Upgrade PicketBox to 5.0.3.Final-redhat-2 from 5.0.3.Final-redhat-1 JBEAP-15334 - Upgrade Infinispan to 9.3.3.Final JBEAP-15347 - (7.2.0) Upgrade jastow to 2.0.6.Final JBEAP-15351 - (7.2.0) Upgrade PicketBox from 5.0.3.Final to 5.0.3.Final-redhat-3 JBEAP-15352 - (7.2.0) Upgrade PicketLink from 2.5.5.SP12 to 2.5.5.SP12-redhat-2 JBEAP-15353 - (7.2.0) Upgrade PicketLink bindings from 2.5.5.SP12 to 2.5.5.SP12-redhat-2 JBEAP-15421 - Upgrade MSC to 1.4.5.Final JBEAP-15431 - Upgrade WildFly Elytron to 1.6.1.Final JBEAP-15446 - Upgrade JGroups to 4.0.15.Final JBEAP-15453 - [PROD](CD14) Upgrade to wildfly-openssl from 1.0.6.Final-redhat-1 to 1.0.6.Final-redhat-2 JBEAP-15494 - (7.2.0) (picketlink) The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml JBEAP-15499 - (7.2.0) (picketlink-bindings) The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml JBEAP-15507 - Upgrade to core 6.0.7.Final JBEAP-15542 - Upgrade Jboss Metadata to 12.0.0.Final JBEAP-15600 - Upgrade jboss-logmanager from 2.1.4.Final to 2.1.5.Final JBEAP-15612 - Upgrade to Galleon and WildFly Galleon Plugins 2.0.1.Final JBEAP-15614 - Upgrade Core EAP to Galleon and WildFly Galleon Plugins 2.0.1.Final JBEAP-15625 - Upgrade smallrye-config 1.3.4 JBEAP-15628 - [GSS](7.2.0) Upgrade jboss-ejb-client from 4.0.11 to 4.0.12 JBEAP-15656 - Upgrade JBossWS to 5.2.4.Final JBEAP-15657 - Upgrade RESTEasy to 3.6.1.SP2 JBEAP-15661 - (7.2.0) Upgrade Hibernate ORM from 5.3.6 to 5.3.7 JBEAP-15666 - (7.2.0) Upgrade HAL to 3.0.7.Final JBEAP-15720 - Upgrade Artemis to 2.6.3.redhat-00008 JBEAP-15731 - Upgrade to WildFly Galleon Plugins 2.0.2.Final and properly configure plugin dependencies JBEAP-15740 - Upgrade to WildFly Core 6.0.11.Final JBEAP-15756 - Upgrade Artemis to 2.6.3.redhat-00012 JBEAP-16031 - Tracker bug for the EAP 7.2.0 text only release

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2019-0139.html

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-200 Information Exposure

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 3

Nessus® Vulnerability Scanner

Date Description
2017-11-16 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-3217.nasl - Type : ACT_GATHER_INFO
2017-11-16 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-3218.nasl - Type : ACT_GATHER_INFO
2017-11-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-3219.nasl - Type : ACT_GATHER_INFO
2017-09-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-2808.nasl - Type : ACT_GATHER_INFO
2017-09-28 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-2809.nasl - Type : ACT_GATHER_INFO
2017-09-27 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-2811.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2019-01-29 21:18:37
  • First insertion