RHSA-2017:1832HighCVSS 8.7

Red Hat Security Advisory: Red Hat JBoss Fuse/A-MQ 6.3 R4 security and bug fix update

Published
August 10, 2017
Last Modified
August 4, 2026

🔗 CVE IDs covered (11)

CVE-2015-6644 →CVE-2016-9879 →CVE-2017-2589 →CVE-2017-3156 →CVE-2017-5643 →CVE-2017-5929 →CVE-2016-8749 →CVE-2017-2594 →CVE-2017-5653 →CVE-2017-5656 →CVE-2017-7957 →

📋 Description

CVE-2015-6644 — bouncycastle: Information disclosure in GCMBlockCipher CVE-2016-8749 — camel-jacksonxml: Unmarshalling operation are vulnerable to RCE CVE-2016-9879 — Security: Improper handling of path parameters allows bypassing the security constraint CVE-2017-2589 — hawtio: Proxy is sharing cookies among all the clients CVE-2017-2594 — hawtio: information Disclosure flaws due to unsafe path traversal CVE-2017-3156 — cxf: CXF OAuth2 Hawk and JOSE MAC Validation code are vulnerable to timing attacks CVE-2017-5643 — camel-core: Validation component vulnerable to SSRF via remote DTDs and XXE CVE-2017-5653 — cxf: CXF JAX-RS XML Security streaming clients do not validate that the service response was signed or encrypted CVE-2017-5656 — cxf: CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens CVE-2017-5929 — logback: Serialization vulnerability in SocketServer and ServerSocketReceiver CVE-2017-7957 — XStream: DoS when unmarshalling void type

🎯 Affected products2

  • Red Hat JBoss A-MQ 6.3
  • Red Hat JBoss Fuse 6.3

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. You can find installation instructions in the download section of the customer portal. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Use a Servlet container known not to include path parameters in the return values for getServletPath() and getPathInfo()

🔗 References (17)