Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Red Hat JBoss Enterprise Application Platform 7.1.6 security update
Informations
Name RHSA-2019:0362 First vendor Publication 2019-02-18
Vendor RedHat Last vendor Modification 2019-02-18
Severity (Vendor) N/A Revision 01

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:L/Au:N/C:N/I:P/A:P)
Cvss Base Score 6.4 Attack Range Network
Cvss Impact Score 4.9 Attack Complexity Low
Cvss Expoit Score 10 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Problem Description:

An update is now available for Red Hat JBoss Enterprise Application Platform 7.1.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This release of Red Hat JBoss Enterprise Application Platform 7.1.6 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1.5, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es):

* wildfly-core: Cross-site scripting (XSS) in JBoss Management Console (CVE-2018-10934)

* undertow: Infoleak in some circumstances where Undertow can serve data from a random buffer (CVE-2018-14642)

* dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents (CVE-2018-1000632)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

3. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must log in to download the update).

The JBoss server process must be restarted for the update to take effect.

4. Bugs fixed (https://bugzilla.redhat.com/):

1615673 - CVE-2018-10934 wildfly-core: Cross-site scripting (XSS) in JBoss Management Console 1620529 - CVE-2018-1000632 dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity of XML documents 1628702 - CVE-2018-14642 undertow: Infoleak in some circumstances where Undertow can serve data from a random buffer

5. JIRA issues fixed (https://issues.jboss.org/):

JBEAP-15311 - (7.1.z) Upgrade Hibernate ORM from 5.1.16 to 5.1.17 JBEAP-15370 - (7.1.z) Upgrade undertow from 1.4.18.SP9 to 1.4.18.SP11 JBEAP-15373 - [GSS](7.1.z) Upgrade ActiveMQ Artemis from 1.5.5.jbossorg-014 to 1.5.5.jbossorg-015 JBEAP-15391 - (7.1.z) Upgrade apache-cxf from 3.1.16.redhat-1 to 3.1.16.redhat-2 JBEAP-15440 - [GSS](7.1.z) Upgrade JBoss Modules from 1.6.5.Final-redhat-00001 to 1.6.7.Final JBEAP-15443 - [GSS](7.1.z) Upgrade PicketLink bindings from 2.5.5.SP12-redhat-2 to 2.5.5.SP12-redhat-3 JBEAP-15444 - [GSS](7.1.z) Upgrade PicketLink from 2.5.5.SP12-redhat-2 to 2.5.5.SP12-redhat-3 JBEAP-15463 - Tracker bug for the EAP 7.1.6 text only release JBEAP-15482 - (7.1.z) Upgrade Elytron from 1.1.11.Final to 1.1.12.Final JBEAP-15483 - (7.1.z) Upgrade Elytron-Tool from 1.0.8 to 1.0.9.Final JBEAP-15525 - [GSS](7.1.z) Upgrade to ironjacamar from 1.4.11.Final to 1.4.12.Final JBEAP-15528 - (7.1.z) Upgrade logmanager from 2.0.10.Final-redhat-1 to 2.0.11.Final JBEAP-15545 - (7.1.z) Upgrade WildFly Core to 3.0.21.Final-redhat-00001 JBEAP-15619 - [GSS](7.1.z) Upgrade jboss-ejb-client from 4.0.11 to 4.0.12 JBEAP-15627 - [GSS](7.1.z) Upgrade jboss-el-api_spec from 1.0.9.Final to 1.0.13.Final JBEAP-15747 - [GSS](7.1.z) Upgrade jastow from 2.0.6.Final-redhat-00001 to 2.0.7.Final JBEAP-15842 - [GSS](7.1.z) Upgrade jberet from 1.2.6 to 1.2.7 JBEAP-15852 - [GSS](7.1.z) Upgrade WildFly Common from 1.2.0.Final-redhat-1 to 1.2.1.Final JBEAP-15891 - [GSS](7.1.z) Upgrade Narayana from 5.5.32 to 5.5.33 JBEAP-16015 - [GSS](7.1.z) Upgrade Narayana from 5.5.32 to 5.5.34 JBEAP-9658 - (7.1.z) Upgrade jboss-negotiation to 3.0.5

Original Source

Url : https://rhn.redhat.com/errata/RHSA-2019-0362.html

CWE : Common Weakness Enumeration

% Id Name
33 % CWE-200 Information Exposure
33 % CWE-91 XML Injection (aka Blind XPath Injection)
33 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 1
Application 1
Application 1
Application 1
Application 2
Application 5
Application 16
Application 2
Application 2
Application 12
Application 1
Application 1
Application 1
Application 1
Os 1

Nessus® Vulnerability Scanner

Date Description
2018-09-25 Name : The remote Debian host is missing a security update.
File : debian_DLA-1517.nasl - Type : ACT_GATHER_INFO

Alert History

If you want to see full details history, please login or register.
0
Date Informations
2020-03-19 13:17:59
  • First insertion