RHSA-2017:1658HighCVSS 7.5
Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 6.4.16 natives update
🔗 CVE IDs covered (4)
📋 Description
CVE-2016-2177 — openssl: Possible integer overflow vulnerabilities in codebase CVE-2016-2178 — openssl: Non-constant time codepath followed for certain operations in DSA implementation CVE-2016-6304 — openssl: OCSP Status Request extension unbounded memory growth CVE-2016-8610 — SSL/TLS: Malformed plain-text ALERT packets could cause remote DoS
🎯 Affected products34
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.ppc64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.src as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.ppc64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.src as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.ppc64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.ppc64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-debuginfo-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.ppc64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.ppc64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-devel-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.ppc64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.ppc64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-libs-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.ppc64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el6.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.ppc64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-perl-1:1.0.2h-13.jbcs.el7.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server
- jbcs-httpd24-openssl-static-1:1.0.2h-13.jbcs.el6.i686 as a component of Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server
- +4 more not shown
✅ Remediation
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. After installing the updated packages, the httpd daemon will be restarted automatically.
🔗 References (11)
- selfhttps://access.redhat.com/errata/RHSA-2017:1658
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/articles/2688611
- externalhttps://access.redhat.com/solutions/222023
- externalhttps://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform/
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1341705
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1343400
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1377600
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1384743
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2017/rhsa-2017_1658.json