RHSA-2017:3454HighCVSS 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.0 security update

Published
December 13, 2017
Last Modified
August 4, 2026

🔗 CVE IDs covered (17)

CVE-2017-7559 →CVE-2016-4993 →CVE-2016-5406 →CVE-2017-2666 →CVE-2017-7525 →CVE-2017-12165 →CVE-2016-8656 →CVE-2017-2595 →CVE-2017-12167 →CVE-2017-7536 →CVE-2016-6311 →CVE-2016-7046 →CVE-2016-7061 →CVE-2016-9589 →CVE-2016-4978 →CVE-2016-8627 →CVE-2017-2670 →

📋 Description

CVE-2016-4978 — Artemis: Deserialization of untrusted input vulnerability CVE-2016-4993 — eap: HTTP header injection / response splitting CVE-2016-5406 — EAP7 Privilege escalation when managing domain including earlier version slaves CVE-2016-6311 — EAP7: Internal IP address disclosed on redirect when request header Host field is not set CVE-2016-7046 — undertow: Long URL proxy request lead to java.nio.BufferOverflowException and DoS CVE-2016-7061 — EAP: Sensitive data can be exposed at the server level in domain mode CVE-2016-8627 — admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files CVE-2016-8656 — jboss: jbossas: unsafe chown of server.log in jboss init script allows privilege escalation CVE-2016-9589 — wildfly: ParseState headerValuesCache can be exploited to fill heap with garbage CVE-2017-2595 — wildfly: Arbitrary file read via path traversal CVE-2017-2666 — undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests CVE-2017-2670 — undertow: IO thread DoS via unclean Websocket closing CVE-2017-7525 — jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper CVE-2017-7536 — hibernate-validator: Privilege escalation when running under the security manager CVE-2017-7559 — undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666) CVE-2017-12165 — undertow: improper whitespace parsing leading to potential HTTP request smuggling CVE-2017-12167 — EAP-7: Wrong privileges on multiple property files

🎯 Affected products200

  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-0:1.5.5.008-1.redhat_1.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-cli-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-commons-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-core-client-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-dto-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-hornetq-protocol-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-hqclient-protocol-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-jdbc-store-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-jms-client-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-jms-server-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-journal-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-native-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-ra-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-selector-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-server-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-activemq-artemis-service-extensions-0:1.5.5.008-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-antlr-0:2.7.7-35.redhat_7.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-antlr-0:2.7.7-35.redhat_7.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-apache-commons-beanutils-0:1.9.3-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-apache-commons-beanutils-0:1.9.3-1.redhat_1.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-apache-commons-cli-0:1.3.1-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-apache-commons-cli-0:1.3.1-1.redhat_1.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-apache-commons-io-0:2.5.0-2.redhat_2.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-apache-commons-io-0:2.5.0-2.redhat_2.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-apache-cxf-0:3.1.12-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-apache-cxf-0:3.1.12-1.redhat_1.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-apache-cxf-rt-0:3.1.12-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-apache-cxf-services-0:3.1.12-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • +170 more not shown

✅ Remediation

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 For the update to take effect, all services linked to the OpenSSL library must be restarted, or the system rebooted. Workaround: You can add a filter in the JBoss CLI that sets the host header to the 'myvirtualhost.com' if the host header is not present. eg: /subsystem=undertow/configuration=filter/expression-filter=hostname:add(expression="header(header=Host, value=myvirtualhost.com)") /subsystem=undertow/server=default-server/host=default-host/filter-ref=hostname:add(predicate="not exists(%{i,Host})") Workaround: Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

🔗 References (22)