RHSA-2017:3244HighCVSS 9.8

Red Hat Security Advisory: Red Hat JBoss Data Grid 7.1.1 security update

Published
November 16, 2017
Last Modified
August 4, 2026

🔗 CVE IDs covered (5)

CVE-2017-5645 →CVE-2017-12629 →CVE-2019-17571 →CVE-2016-0750 →CVE-2017-2670 →

📋 Description

CVE-2016-0750 — client: unchecked deserialization in marshaller util CVE-2017-2670 — undertow: IO thread DoS via unclean Websocket closing CVE-2017-5645 — log4j: Socket receiver deserialization vulnerability CVE-2017-12629 — Solr: Code execution via entity expansion CVE-2019-17571 — log4j: deserialization of untrusted data in SocketServer

🎯 Affected products1

  • Red Hat JBoss Data Grid 7.1

✅ Remediation

The References section of this erratum contains a download link (you must log in to download the update). Before applying the update, back up your existing Red Hat JBoss Data Grid installation (including databases, configuration files, and so on). Workaround: Until fixes are available, all Solr users are advised to restart their Solr instances with the system parameter `-Ddisable.configEdit=true`. This will disallow any changes to be made to configurations via the Config API. This is a key factor in this vulnerability, since it allows GET requests to add the RunExecutableListener to the config. This is sufficient to protect from this type of attack, but means you cannot use the edit capabilities of the Config API until further fixes are in place. Workaround: Please note that the Log4j upstream strongly recommends against using the SerializedLayout with the SocketAppenders. Customers may mitigate this issue by removing the SocketServer class outright; or if they must continue to use SocketAppenders, they can modify their SocketAppender configuration from SerializedLayout to use JsonLayout instead. An example of this in log4j-server.properties might look like this: log4j.appender.file.layout=org.apache.log4j.JsonLayout

🔗 References (9)