RHSA-2017:1409MediumCVSS 8.1
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update
🔗 CVE IDs covered (4)
📋 Description
CVE-2016-9606 — Resteasy: Yaml unmarshalling vulnerable to RCE CVE-2017-2595 — wildfly: Arbitrary file read via path traversal CVE-2017-2666 — undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests CVE-2017-2670 — undertow: IO thread DoS via unclean Websocket closing
🎯 Affected products1
- Red Hat JBoss EAP 7
✅ Remediation
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Add authentication and authorization to any Resteasy endpoint which doesn't define a mime type, or defines a multipart mime type.
🔗 References (10)
- selfhttps://access.redhat.com/errata/RHSA-2017:1409
- externalhttps://access.redhat.com/security/updates/classification/#moderate
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.0
- externalhttps://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/version-7.0/
- externalhttps://access.redhat.com/documentation/en/jboss-enterprise-application-platform/
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1400644
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1413028
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1436163
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1438885
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1409.json