RHSA-2018:0480HighCVSS 8.6

Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 for RHEL 7

Published
March 12, 2018
Last Modified
August 4, 2026

🔗 CVE IDs covered (8)

CVE-2018-1048 →CVE-2018-5968 →CVE-2017-7561 →CVE-2017-12174 →CVE-2017-12196 →CVE-2017-15089 →CVE-2017-15095 →CVE-2017-17485 →

📋 Description

CVE-2017-7561 — resteasy: Vary header not added by CORS filter leading to cache poisoning CVE-2017-12174 — artemis/hornetq: memory exhaustion via UDP and JGroups discovery CVE-2017-12196 — undertow: Client can use bogus uri in Digest authentication CVE-2017-15089 — infinispan: Unsafe deserialization of malicious object injected into data cache CVE-2017-15095 — jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) CVE-2017-17485 — jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) CVE-2018-1048 — undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser CVE-2018-5968 — jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)

🎯 Affected products156

  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-0:1.5.5.009-1.redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-cli-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-commons-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-core-client-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-dto-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-hornetq-protocol-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-hqclient-protocol-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-jdbc-store-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-jms-client-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-jms-server-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-journal-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-native-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-ra-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-selector-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-server-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-activemq-artemis-service-extensions-0:1.5.5.009-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-apache-cxf-0:3.1.13-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-apache-cxf-0:3.1.13-1.redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-apache-cxf-rt-0:3.1.13-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-apache-cxf-services-0:3.1.13-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-apache-cxf-tools-0:3.1.13-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-glassfish-jsf-0:2.2.13-6.SP5_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-glassfish-jsf-0:2.2.13-6.SP5_redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-hibernate-0:5.1.12-1.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-hibernate-0:5.1.12-1.Final_redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-hibernate-core-0:5.1.12-1.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-hibernate-entitymanager-0:5.1.12-1.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-hibernate-envers-0:5.1.12-1.Final_redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • +126 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

🔗 References (14)