Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Red Hat Fuse 7.5.0 security update
Informations
Name RHSA-2019:3892 First vendor Publication 2019-11-14
Vendor RedHat Last vendor Modification 2019-11-14
Severity (Vendor) N/A Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:C/I:C/A:C)
Cvss Base Score 9.3 Attack Range Network
Cvss Impact Score 10 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

A minor version update (from 7.4 to 7.5) is now available for Red Hat Fuse. The purpose of this text-only errata is to inform you about the security issues fixed in this release.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Description:

This release of Red Hat Fuse 7.5.0 serves as a replacement for Red Hat Fuse 7.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es):

* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095)

* jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) (CVE-2017-17485)

* infinispan: deserialization of data in XML and JSON transcoders (CVE-2018-1131)

* hadoop: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file (CVE-2018-8009)

* jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis (CVE-2018-11307)

* jackson-databind: improper polymorphic deserialization of types from Jodd-db library (CVE-2018-12022)

* jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver (CVE-2018-12023)

* jackson-databind: arbitrary code execution in slf4j-ext class (CVE-2018-14718)

* jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes (CVE-2018-14719)

* jackson-databind: exfiltration/XXE in some JDK classes (CVE-2018-14720)

* jackson-databind: improper polymorphic deserialization in axis2-transport-jms class (CVE-2018-19360)

* jackson-databind: improper polymorphic deserialization in openjpa class (CVE-2018-19361)

* jackson-databind: improper polymorphic deserialization in jboss-common-core class (CVE-2018-19362)

* retrofit: Directory traversal in RequestBuilder allows manipulation of resources (CVE-2018-1000850)

* zookeeper: Information disclosure in Apache ZooKeeper (CVE-2019-0201)

* mesos: docker image code execution (CVE-2019-0204)

* HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

* HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

* HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

* HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

* xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285) (CVE-2019-10173)

* syndesis: default CORS configuration is allow all (CVE-2019-14860)

* netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers (CVE-2019-16869)

* activemq: ActiveMQ Client Missing TLS Hostname Verification (CVE-2018-11775)

* tika: Incomplete fix allows for XML entity expansion resulting in denial of service (CVE-2018-11796)

* jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class (CVE-2018-14721)

* tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

3. Solution:

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.5.0 product documentation page: https://access.redhat.com/documentation/en-us/red_hat_fuse/7.5/

4. Bugs fixed (https://bugzilla.redhat.com/):

1506612 - CVE-2017-15095 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) 1528565 - CVE-2017-17485 jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) 1576492 - CVE-2018-1131 infinispan: deserialization of data in XML and JSON transcoders 1593018 - CVE-2018-8009 hadoop: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file 1607580 - CVE-2018-8034 tomcat: Host name verification missing in WebSocket client 1629083 - CVE-2018-11775 activemq: ActiveMQ Client Missing TLS Hostname Verification 1639090 - CVE-2018-11796 tika: Incomplete fix allows for XML entity expansion resulting in denial of service 1663904 - CVE-2018-1000850 retrofit: Directory traversal in RequestBuilder allows manipulation of resources 1666415 - CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class 1666418 - CVE-2018-14719 jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes 1666423 - CVE-2018-14720 jackson-databind: exfiltration/XXE in some JDK classes 1666428 - CVE-2018-14721 jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class 1666482 - CVE-2018-19360 jackson-databind: improper polymorphic deserialization in axis2-transport-jms class 1666484 - CVE-2018-19361 jackson-databind: improper polymorphic deserialization in openjpa class 1666489 - CVE-2018-19362 jackson-databind: improper polymorphic deserialization in jboss-common-core class 1671096 - CVE-2018-12023 jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver 1671097 - CVE-2018-12022 jackson-databind: improper polymorphic deserialization of types from Jodd-db library 1677341 - CVE-2018-11307 jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis 1692755 - CVE-2019-0204 mesos: docker image code execution 1715197 - CVE-2019-0201 zookeeper: Information disclosure in Apache ZooKeeper 1722971 - CVE-2019-10173 xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285) 1735645 - CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth 1735744 - CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth 1735745 - CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth 1735749 - CVE-2019-9518 HTTP/2: flood using empty frames results in excessive resource consumption 1758619 - CVE-2019-16869 netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers 1761912 - CVE-2019-14860 syndesis: default CORS configuration is allow all

5. References:

https://access.redhat.com/security/cve/CVE-2017-15095 https://access.redhat.com/security/cve/CVE-2017-17485 https://access.redhat.com/security/cve/CVE-2018-1131 https://access.redhat.com/security/cve/CVE-2018-8009 https://access.redhat.com/security/cve/CVE-2018-8034 https://access.redhat.com/security/cve/CVE-2018-11307 https://access.redhat.com/security/cve/CVE-2018-11775 https://access.redhat.com/security/cve/CVE-2018-11796 https://access.redhat.com/security/cve/CVE-2018-12022 https://access.redhat.com/security/cve/CVE-2018-12023 https://access.redhat.com/security/cve/CVE-2018-14718 https://access.redhat.com/security/cve/CVE-2018-14719 https://access.redhat.com/security/cve/CVE-2018-14720 https://access.redhat.com/security/cve/CVE-2018-14721 https://access.redhat.com/security/cve/CVE-2018-19360 https://access.redhat.com/security/cve/CVE-2018-19361 https://access.redhat.com/security/cve/CVE-2018-19362 https://access.redhat.com/security/cve/CVE-2018-1000850 https://access.redhat.com/security/cve/CVE-2019-0201 https://access.redhat.com/security/cve/CVE-2019-0204 https://access.redhat.com/security/cve/CVE-2019-9512 https://access.redhat.com/security/cve/CVE-2019-9514 https://access.redhat.com/security/cve/CVE-2019-9515 https://access.redhat.com/security/cve/CVE-2019-9518 https://access.redhat.com/security/cve/CVE-2019-10173 https://access.redhat.com/security/cve/CVE-2019-14860 https://access.redhat.com/security/cve/CVE-2019-16869 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.5.0 https://access.redhat.com/documentation/en-us/red_hat_fuse/7.5/

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2019-3892.html

CWE : Common Weakness Enumeration

% Id Name
50 % CWE-502 Deserialization of Untrusted Data
12 % CWE-770 Allocation of Resources Without Limits or Throttling
8 % CWE-611 Information Leak Through XML External Entity File Disclosure
8 % CWE-295 Certificate Issues
8 % CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE/SANS Top 25)
4 % CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')
4 % CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
4 % CWE-78 Improper Sanitization of Special Elements used in an OS Command ('OS Command Injection') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 53
Application 1
Application 72
Application 16
Application 3
Application 465
Application 30
Application 12
Application 15
Application 5
Application 18
Application 1
Application 1
Application 1
Application 2
Application 1
Application 1
Application 1
Application 2
Application 50
Application 12
Application 3
Application 2
Application 1
Application 2
Application 2
Application 2
Application 6
Application 3
Application 2
Application 6
Application 2
Application 3
Application 1
Application 12
Application 5
Application 2
Application 1
Application 1
Application 2
Application 1
Application 1
Application 2
Application 2
Application 15
Application 31
Application 1
Application 2
Application 3
Application 1
Application 1
Application 1
Application 12
Application 6
Application 1
Application 11
Application 3
Application 1
Application 1
Application 6
Application 1
Application 1
Application 1
Application 1
Application 25
Application 1
Application 1
Application 1
Application 1
Application 1
Application 2
Os 3
Os 3
Os 1
Os 1

Snort® IPS/IDS

Date Description
2018-04-03 Jackson databind deserialization remote code execution attempt
RuleID : 45779 - Revision : 1 - Type : SERVER-OTHER
2018-04-03 Jackson databind deserialization remote code execution attempt
RuleID : 45778 - Revision : 1 - Type : SERVER-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45016 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45015 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45014 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45013 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45012 - Revision : 4 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45011 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45010 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45009 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45008 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45007 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45006 - Revision : 4 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45005 - Revision : 4 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45004 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45003 - Revision : 3 - Type : FILE-OTHER
2017-12-29 Jackson databind deserialization remote code execution attempt
RuleID : 45002 - Revision : 3 - Type : FILE-OTHER

Nessus® Vulnerability Scanner

Date Description
2019-01-03 Name : The remote Fedora host is missing a security update.
File : fedora_2018-e5a8b72d0d.nasl - Type : ACT_GATHER_INFO
2019-01-03 Name : The remote Fedora host is missing a security update.
File : fedora_2018-b1832101b8.nasl - Type : ACT_GATHER_INFO
2018-11-29 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_93f8e0fff33d11e8be460019dbb15b3f.nasl - Type : ACT_GATHER_INFO
2018-09-14 Name : A web application running on the remote host is affected by an man-in-the-mid...
File : activemq_5_15_6.nasl - Type : ACT_GATHER_INFO
2018-09-04 Name : The remote Debian host is missing a security update.
File : debian_DLA-1491.nasl - Type : ACT_GATHER_INFO
2018-08-30 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-4281.nasl - Type : ACT_GATHER_INFO
2018-08-10 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2018-1056.nasl - Type : ACT_GATHER_INFO
2018-08-10 Name : The remote Amazon Linux AMI host is missing a security update.
File : ala_ALAS-2018-1055.nasl - Type : ACT_GATHER_INFO
2018-07-30 Name : The remote Debian host is missing a security update.
File : debian_DLA-1453.nasl - Type : ACT_GATHER_INFO
2018-05-04 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-4190.nasl - Type : ACT_GATHER_INFO
2018-02-16 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-4114.nasl - Type : ACT_GATHER_INFO
2018-01-15 Name : The remote Fedora host is missing a security update.
File : fedora_2017-4a071ecbc7.nasl - Type : ACT_GATHER_INFO
2017-12-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-3455.nasl - Type : ACT_GATHER_INFO
2017-12-15 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-3454.nasl - Type : ACT_GATHER_INFO
2017-12-14 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-3458.nasl - Type : ACT_GATHER_INFO
2017-12-04 Name : A web application running on the remote host uses a Java framework that is af...
File : struts_2_5_14_1.nasl - Type : ACT_GATHER_INFO
2017-11-17 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-4037.nasl - Type : ACT_GATHER_INFO
2017-11-16 Name : The remote Fedora host is missing a security update.
File : fedora_2017-e16ed3f7a1.nasl - Type : ACT_GATHER_INFO
2017-11-14 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-3189.nasl - Type : ACT_GATHER_INFO
2017-11-10 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2017-3141.nasl - Type : ACT_GATHER_INFO
2017-10-23 Name : The remote Debian host is missing a security-related update.
File : debian_DSA-4004.nasl - Type : ACT_GATHER_INFO
2017-09-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-2638.nasl - Type : ACT_GATHER_INFO
2017-09-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-2637.nasl - Type : ACT_GATHER_INFO
2017-09-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-2636.nasl - Type : ACT_GATHER_INFO
2017-09-08 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-2635.nasl - Type : ACT_GATHER_INFO
2017-08-14 Name : The remote Fedora host is missing a security update.
File : fedora_2017-f452765e1e.nasl - Type : ACT_GATHER_INFO
2017-08-14 Name : The remote Fedora host is missing a security update.
File : fedora_2017-6a75c816fa.nasl - Type : ACT_GATHER_INFO
2017-08-11 Name : The remote Fedora host is missing a security update.
File : fedora_2017-8df9efed5f.nasl - Type : ACT_GATHER_INFO
2017-08-03 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-1837.nasl - Type : ACT_GATHER_INFO
2017-08-03 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-1835.nasl - Type : ACT_GATHER_INFO
2017-08-03 Name : The remote Red Hat host is missing one or more security updates.
File : redhat-RHSA-2017-1834.nasl - Type : ACT_GATHER_INFO
2016-12-13 Name : The remote Gentoo host is missing one or more security-related patches.
File : gentoo_GLSA-201612-35.nasl - Type : ACT_GATHER_INFO
2014-11-08 Name : The remote Red Hat host is missing a security update.
File : redhat-RHSA-2014-0389.nasl - Type : ACT_GATHER_INFO
2014-03-12 Name : The remote web application uses a library with a remote code execution vulner...
File : artifactory_3_1_1_1.nasl - Type : ACT_GATHER_INFO
2014-02-25 Name : The remote web server hosts a job scheduling / management system that is affe...
File : jenkins_1_551.nasl - Type : ACT_GATHER_INFO
2014-02-23 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2372.nasl - Type : ACT_GATHER_INFO
2014-02-23 Name : The remote Fedora host is missing a security update.
File : fedora_2014-2340.nasl - Type : ACT_GATHER_INFO
2014-02-17 Name : The remote FreeBSD host is missing one or more security-related updates.
File : freebsd_pkg_3e0507c6961411e3b3a500e0814cab4e.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2020-03-19 13:19:37
  • First insertion