Moderate: Red Hat JBoss Enterprise Application Platform 6.4.11 update on RHEL 7

Related Vulnerabilities: CVE-2016-3092   CVE-2016-3092  

Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform 6.4.11 update on RHEL 7

Type/Severity

Security Advisory: Moderate

Topic

Updated packages that provide Red Hat JBoss Enterprise Application Platform 6.4.11, fix several bugs, and add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7.

This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.10. It includes bug fixes and enhancements. Documentation for these changes will be available shortly from the Red Hat JBoss Enterprise Application Platform 6.4.11 Release Notes, linked to in the References.

All users of Red Hat JBoss Enterprise Application Platform 6.4 on Red Hat Enterprise Linux 7 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.

Security Fix(es):

  • A denial of service vulnerability was identified in Commons FileUpload that occurred when the length of the multipart boundary was just below the size of the buffer (4096 bytes) used to read the uploaded file if the boundary was the typical tens of bytes long. (CVE-2016-3092)

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • JBoss Enterprise Application Platform 6.4 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 6.4 for RHEL 7 ppc64
  • JBoss Enterprise Application Platform 6 for RHEL 7 x86_64
  • JBoss Enterprise Application Platform 6 for RHEL 7 ppc64

Fixes

  • BZ - 1349468 - CVE-2016-3092 tomcat: Usage of vulnerable FileUpload package can result in denial of service
  • BZ - 1375627 - RHEL7 RPMs: Upgrade jbossts to 4.17.35.Final-redhat-1
  • BZ - 1376067 - RHEL7 RPMs: Upgrade jboss-remote-naming to 1.0.13.Final-redhat-1
  • BZ - 1376187 - RHEL7 RPMs: Upgrade jbossweb to 7.5.19.Final-redhat-1

CVEs

References