Executive Summary
Summary | |
---|---|
Title | Red Hat JBoss Enterprise Application Platform 7.2.0 security update |
Informations | |||
---|---|---|---|
Name | RHSA-2019:0139 | First vendor Publication | 2019-01-22 |
Vendor | RedHat | Last vendor Modification | 2019-01-22 |
Severity (Vendor) | N/A | Revision | 01 |
Security-Database Scoring CVSS v3
Cvss vector : N/A | |||
---|---|---|---|
Overall CVSS Score | NA | ||
Base Score | NA | Environmental Score | NA |
impact SubScore | NA | Temporal Score | NA |
Exploitabality Sub Score | NA | ||
Calculate full CVSS 3.0 Vectors scores |
Security-Database Scoring CVSS v2
Cvss vector : (AV:N/AC:L/Au:S/C:P/I:N/A:N) | |||
---|---|---|---|
Cvss Base Score | 4 | Attack Range | Network |
Cvss Impact Score | 2.9 | Attack Complexity | Low |
Cvss Expoit Score | 8 | Authentication | Requires single instance |
Calculate full CVSS 2.0 Vectors scores |
Detail
Problem Description: Red Hat JBoss Enterprise Application Platform 7.2.0 is now available. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.0 Release Notes for information on the most significant bug fixes and enhancements included in this release. Security Fix(es): * picketlink: SAML request parser replaces special strings with system properties (CVE-2017-2582) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. The CVE-2017-2582 issue was discovered by Hynek Mlnarik (Red Hat). 3. Solution: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). The JBoss server process must be restarted for the update to take effect. 4. Bugs fixed (https://bugzilla.redhat.com/): 1410481 - CVE-2017-2582 picketlink, keycloak: SAML request parser replaces special strings with system properties 5. JIRA issues fixed (https://issues.jboss.org/): JBEAP-12932 - Upgrade WildFly Core to 4.0.1.Final JBEAP-13189 - Upgrade Generic JMS RA 2.0.1.Final JBEAP-13658 - Upgrade JGroups to 3.6.15.Final JBEAP-13867 - [Artemis upgrade] Transformer interface was changed JBEAP-13895 - [GSS](7.2.0) Upgrade picketlink from 2.5.5.SP8 to 2.5.5.SP9 JBEAP-14222 - (EL12) Upgrade Infinispan to 9.1.6.Final to 9.1.7.Final JBEAP-14239 - (EL12) Upgrade Artemis to 1.5.5.009-redhat-1 JBEAP-14386 - (7.2.0.EO12) Upgrade slf4j from 1.7.22.redhat-1 to 1.7.22.redhat-2 JBEAP-14415 - Upgrade WildFly Core to 4.0.1.Final-redhat-1 JBEAP-14421 - Upgrade WildFly Elytron Tool to 1.1.4.Final JBEAP-14422 - Upgrade WildFly Elytron to 1.2.4.Final JBEAP-14427 - Upgrade Undertow to 2.0.0.SP1 JBEAP-14504 - Upgrade WildFly HTTP client 1.0.12.Final JBEAP-14581 - (CD12) Upgrade FasterXML Jackson from 2.9.4.redhat-1 to 2.9.5.redhat-1 JBEAP-14811 - 7.2 - Migration Guide: Upgrade org.apache.santuario.xmlsec to 2.1.1. caused regression in PicketLinkSTS JBEAP-14852 - Upgrade to Galleon 1.0.1.Final and Galleon Plugins 1.0.1.Final (core) JBEAP-14853 - Upgrade to Galleon 1.0.1.Final and Galleon Plugins 1.0.1.Final (full) JBEAP-14854 - [7.2] Migration Guide: document upgrade from Hibernate ORM 5.1 to 5.3 JBEAP-14881 - Upgrade PicketBox to 5.0.3.Final JBEAP-15030 - [CD14] Clarify wording on EJB timers before upgrade/migration JBEAP-15044 - Upgrade to Apache CXF from 3.2.4 to 3.2.5 JBEAP-15046 - Upgrade to Apache CXF 3.2.5 JBEAP-15069 - Installer: Upgrade IzPack aesh-readline to 1.10 JBEAP-15123 - Upgrade PicketBox to 5.0.3.Final-redhat-2 from 5.0.3.Final-redhat-1 JBEAP-15334 - Upgrade Infinispan to 9.3.3.Final JBEAP-15347 - (7.2.0) Upgrade jastow to 2.0.6.Final JBEAP-15351 - (7.2.0) Upgrade PicketBox from 5.0.3.Final to 5.0.3.Final-redhat-3 JBEAP-15352 - (7.2.0) Upgrade PicketLink from 2.5.5.SP12 to 2.5.5.SP12-redhat-2 JBEAP-15353 - (7.2.0) Upgrade PicketLink bindings from 2.5.5.SP12 to 2.5.5.SP12-redhat-2 JBEAP-15421 - Upgrade MSC to 1.4.5.Final JBEAP-15431 - Upgrade WildFly Elytron to 1.6.1.Final JBEAP-15446 - Upgrade JGroups to 4.0.15.Final JBEAP-15453 - [PROD](CD14) Upgrade to wildfly-openssl from 1.0.6.Final-redhat-1 to 1.0.6.Final-redhat-2 JBEAP-15494 - (7.2.0) (picketlink) The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml JBEAP-15499 - (7.2.0) (picketlink-bindings) The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml JBEAP-15507 - Upgrade to core 6.0.7.Final JBEAP-15542 - Upgrade Jboss Metadata to 12.0.0.Final JBEAP-15600 - Upgrade jboss-logmanager from 2.1.4.Final to 2.1.5.Final JBEAP-15612 - Upgrade to Galleon and WildFly Galleon Plugins 2.0.1.Final JBEAP-15614 - Upgrade Core EAP to Galleon and WildFly Galleon Plugins 2.0.1.Final JBEAP-15625 - Upgrade smallrye-config 1.3.4 JBEAP-15628 - [GSS](7.2.0) Upgrade jboss-ejb-client from 4.0.11 to 4.0.12 JBEAP-15656 - Upgrade JBossWS to 5.2.4.Final JBEAP-15657 - Upgrade RESTEasy to 3.6.1.SP2 JBEAP-15661 - (7.2.0) Upgrade Hibernate ORM from 5.3.6 to 5.3.7 JBEAP-15666 - (7.2.0) Upgrade HAL to 3.0.7.Final JBEAP-15720 - Upgrade Artemis to 2.6.3.redhat-00008 JBEAP-15731 - Upgrade to WildFly Galleon Plugins 2.0.2.Final and properly configure plugin dependencies JBEAP-15740 - Upgrade to WildFly Core 6.0.11.Final JBEAP-15756 - Upgrade Artemis to 2.6.3.redhat-00012 JBEAP-16031 - Tracker bug for the EAP 7.2.0 text only release |
Original Source
Url : https://rhn.redhat.com/errata/RHSA-2019-0139.html |
CWE : Common Weakness Enumeration
% | Id | Name |
---|---|---|
100 % | CWE-200 | Information Exposure |
CPE : Common Platform Enumeration
Type | Description | Count |
---|---|---|
Application | 3 |
Nessus® Vulnerability Scanner
Date | Description |
---|---|
2017-11-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3217.nasl - Type : ACT_GATHER_INFO |
2017-11-16 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3218.nasl - Type : ACT_GATHER_INFO |
2017-11-15 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-3219.nasl - Type : ACT_GATHER_INFO |
2017-09-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2808.nasl - Type : ACT_GATHER_INFO |
2017-09-28 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2809.nasl - Type : ACT_GATHER_INFO |
2017-09-27 | Name : The remote Red Hat host is missing one or more security updates. File : redhat-RHSA-2017-2811.nasl - Type : ACT_GATHER_INFO |
Alert History
Date | Informations |
---|---|
2019-01-29 21:18:37 |
|