RHSA-2017:3456HighCVSS 8.1

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.0 security update

Published
December 13, 2017
Last Modified
August 4, 2026

🔗 CVE IDs covered (17)

CVE-2016-4978 →CVE-2016-7046 →CVE-2016-7066 →CVE-2017-7536 →CVE-2017-2595 →CVE-2017-2670 →CVE-2017-7559 →CVE-2016-4993 →CVE-2016-6311 →CVE-2016-7061 →CVE-2017-7525 →CVE-2017-12165 →CVE-2017-12167 →CVE-2016-5406 →CVE-2016-8627 →CVE-2016-9589 →CVE-2017-2666 →

📋 Description

CVE-2016-4978 — Artemis: Deserialization of untrusted input vulnerability CVE-2016-4993 — eap: HTTP header injection / response splitting CVE-2016-5406 — EAP7 Privilege escalation when managing domain including earlier version slaves CVE-2016-6311 — EAP7: Internal IP address disclosed on redirect when request header Host field is not set CVE-2016-7046 — undertow: Long URL proxy request lead to java.nio.BufferOverflowException and DoS CVE-2016-7061 — EAP: Sensitive data can be exposed at the server level in domain mode CVE-2016-7066 — admin-cli: Any local users can connect to jboss-cli CVE-2016-8627 — admin-cli: Potential EAP resource starvation DOS attack via GET requests for server log files CVE-2016-9589 — wildfly: ParseState headerValuesCache can be exploited to fill heap with garbage CVE-2017-2595 — wildfly: Arbitrary file read via path traversal CVE-2017-2666 — undertow: HTTP Request smuggling vulnerability due to permitting invalid characters in HTTP requests CVE-2017-2670 — undertow: IO thread DoS via unclean Websocket closing CVE-2017-7525 — jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper CVE-2017-7536 — hibernate-validator: Privilege escalation when running under the security manager CVE-2017-7559 — undertow: HTTP Request smuggling vulnerability (incomplete fix of CVE-2017-2666) CVE-2017-12165 — undertow: improper whitespace parsing leading to potential HTTP request smuggling CVE-2017-12167 — EAP-7: Wrong privileges on multiple property files

🎯 Affected products1

  • Red Hat JBoss EAP 7

✅ Remediation

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). Workaround: You can add a filter in the JBoss CLI that sets the host header to the 'myvirtualhost.com' if the host header is not present. eg: /subsystem=undertow/configuration=filter/expression-filter=hostname:add(expression="header(header=Host, value=myvirtualhost.com)") /subsystem=undertow/server=default-server/host=default-host/filter-ref=hostname:add(predicate="not exists(%{i,Host})") Workaround: Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

🔗 References (23)