What is RHSA-2017:1412?

RHSA-2017:1412 is a security advisory published by Red Hat Product Security with Medium severity. Red Hat Security Advisory: eap7-jboss-ec2-eap security update

Which CVE IDs does RHSA-2017:1412 cover?

RHSA-2017:1412 covers the following CVE IDs: CVE-2016-9606, CVE-2017-2595, CVE-2017-2666, CVE-2017-2670. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of RHSA-2017:1412?

RHSA-2017:1412 has a CVSS v3 base score of 8.1, published by Red Hat Product Security.

Which products are affected by RHSA-2017:1412?

RHSA-2017:1412 affects 8 products, including: Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server; Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server; eap7-jboss-ec2-eap-0:7.0.6-1.GA_redhat_1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server; eap7-jboss-ec2-eap-0:7.0.6-1.GA_redhat_1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server; eap7-jboss-ec2-eap-0:7.0.6-1.GA_redhat_1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server; and others — see the full list on the advisory page.

RHSA-2017:1412MediumCVSS 8.1

Red Hat Security Advisory: eap7-jboss-ec2-eap security update

Vendor

Red Hat Product Security

Published

June 7, 2017

Last Modified

August 4, 2026

🔗 CVE IDs covered (4)

CVE-2016-9606 →CVE-2017-2595 →CVE-2017-2666 →CVE-2017-2670 →

📋 Description

CVE-2016-9606 — Resteasy: Yaml unmarshalling vulnerable to RCE CVE-2017-2595 — wildfly: Arbitrary file read via path traversal CVE-2017-2666 — undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests CVE-2017-2670 — undertow: IO thread DoS via unclean Websocket closing

🎯 Affected products8

Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server
Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
eap7-jboss-ec2-eap-0:7.0.6-1.GA_redhat_1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server
eap7-jboss-ec2-eap-0:7.0.6-1.GA_redhat_1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server
eap7-jboss-ec2-eap-0:7.0.6-1.GA_redhat_1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
eap7-jboss-ec2-eap-0:7.0.6-1.GA_redhat_1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
eap7-jboss-ec2-eap-samples-0:7.0.6-1.GA_redhat_1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 6 Server
eap7-jboss-ec2-eap-samples-0:7.0.6-1.GA_redhat_1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server

✅ Remediation

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Add authentication and authorization to any Resteasy endpoint which doesn't define a mime type, or defines a multipart mime type.

🔗 CVE IDs covered (4)

📋 Description

🎯 Affected products8

✅ Remediation

🔗 References (11)