Synopsis
Moderate: Red Hat JBoss Enterprise Application Platform 6.4.16 update on RHEL 6
Type/Severity
Security Advisory: Moderate
Topic
An update is now available for Red Hat JBoss Enterprise Application
Platform 6.4 for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
Description
Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.
This release of Red Hat JBoss Enterprise Application Platform 6.4.16
serves as a replacement for Red Hat JBoss Enterprise Application Platform
6.4.15, and includes bug fixes and enhancements, which are documented
in the Release Notes document linked to in the References.
Security Fix(es):
- It was found that the log file viewer in Red Hat JBoss Enterprise
Application 6 and 7 allows arbitrary file read to authenticated user via
path traversal. (CVE-2017-2595)
- It was discovered that a malicious web application could bypass a
configured SecurityManager via a Tomcat utility method that was accessible
to web applications. (CVE-2016-5018)
- It was discovered that a malicious web application could bypass a
configured SecurityManager via manipulation of the configuration parameters
for the JSP Servlet. (CVE-2016-6796)
Solution
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
Affected Products
-
JBoss Enterprise Application Platform 6.4 for RHEL 6 x86_64
-
JBoss Enterprise Application Platform 6.4 for RHEL 6 ppc64
-
JBoss Enterprise Application Platform 6.4 for RHEL 6 i386
-
JBoss Enterprise Application Platform 6 for RHEL 6 x86_64
-
JBoss Enterprise Application Platform 6 for RHEL 6 ppc64
-
JBoss Enterprise Application Platform 6 for RHEL 6 i386
Fixes
- BZ - 1390515 - CVE-2016-6796 tomcat: security manager bypass via JSP Servlet config parameters
- BZ - 1390525 - CVE-2016-5018 tomcat: security manager bypass via IntrospectHelper utility function
- BZ - 1413028 - CVE-2017-2595 wildfly: Arbitrary file read via path traversal
- BZ - 1456746 - RHEL6 RPMs: Upgrade jboss-marshalling to 1.4.10.SP2-redhat-1
CVEs
References
Vulmon