RHSA-2018:0478HighCVSS 8.6

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.1 security update

Published
March 12, 2018
Last Modified
August 4, 2026

🔗 CVE IDs covered (8)

CVE-2017-12196 →CVE-2017-15089 →CVE-2017-15095 →CVE-2017-17485 →CVE-2018-1048 →CVE-2018-5968 →CVE-2017-7561 →CVE-2017-12174 →

📋 Description

CVE-2017-7561 — resteasy: Vary header not added by CORS filter leading to cache poisoning CVE-2017-12174 — artemis/hornetq: memory exhaustion via UDP and JGroups discovery CVE-2017-12196 — undertow: Client can use bogus uri in Digest authentication CVE-2017-15089 — infinispan: Unsafe deserialization of malicious object injected into data cache CVE-2017-15095 — jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) CVE-2017-17485 — jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) CVE-2018-1048 — undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser CVE-2018-5968 — jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)

🎯 Affected products1

  • Red Hat JBoss EAP 7

✅ Remediation

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

🔗 References (14)