RHSA-2017:2808HighCVSS 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform security update

Published
September 26, 2017
Last Modified
August 4, 2026

🔗 CVE IDs covered (5)

CVE-2014-9970 →CVE-2015-6644 →CVE-2017-2582 →CVE-2017-5645 →CVE-2017-7536 →

📋 Description

CVE-2014-9970 — jasypt: Vulnerable to timing attack against the password hash comparison CVE-2015-6644 — bouncycastle: Information disclosure in GCMBlockCipher CVE-2017-2582 — keycloak: SAML request parser replaces special strings with system properties CVE-2017-5645 — log4j: Socket receiver deserialization vulnerability CVE-2017-7536 — hibernate-validator: Privilege escalation when running under the security manager

🎯 Affected products50

  • Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-artemis-native-0:1.1.0-13.redhat_4.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-artemis-native-0:1.1.0-13.redhat_4.ep7.el7.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-artemis-native-wildfly-0:1.1.0-13.redhat_4.ep7.el7.x86_64 as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-bouncycastle-0:1.56.0-3.redhat_2.2.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-bouncycastle-0:1.56.0-3.redhat_2.2.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-bouncycastle-mail-0:1.56.0-3.redhat_2.2.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-bouncycastle-pkix-0:1.56.0-3.redhat_2.2.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-bouncycastle-prov-0:1.56.0-3.redhat_2.2.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-hibernate-validator-0:5.2.5-2.Final_redhat_2.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-hibernate-validator-0:5.2.5-2.Final_redhat_2.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-hibernate-validator-cdi-0:5.2.5-2.Final_redhat_2.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jasypt-0:1.9.2-2.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jasypt-0:1.9.2-2.redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-jms-api_2.0_spec-0:1.0.1-2.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-jms-api_2.0_spec-0:1.0.1-2.Final_redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-logmanager-0:2.0.7-2.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-logmanager-0:2.0.7-2.Final_redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-metadata-0:10.0.2-2.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-metadata-0:10.0.2-2.Final_redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-metadata-appclient-0:10.0.2-2.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-metadata-common-0:10.0.2-2.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-metadata-ear-0:10.0.2-2.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-metadata-ejb-0:10.0.2-2.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-metadata-web-0:10.0.2-2.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-remote-naming-0:2.0.5-1.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-remote-naming-0:2.0.5-1.Final_redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-remoting-0:4.0.24-1.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-jboss-remoting-0:4.0.24-1.Final_redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • eap7-log4j-jboss-logmanager-0:1.1.4-2.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.0 for RHEL 7 Server
  • +20 more not shown

✅ Remediation

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (11)