Red Hat Security Advisory: JBoss Enterprise Application Platform 7.1.1 for RHEL 7

CVE-2017-7561 — resteasy: Vary header not added by CORS filter leading to cache poisoning CVE-2017-12174 — artemis/hornetq: memory exhaustion via UDP and JGroups discovery CVE-2017-12196 — undertow: Client can use bogus uri in Digest authentication CVE-2017-15089 — infinispan: Unsafe deserialization of malicious object injected into data cache CVE-2017-15095 — jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) CVE-2017-17485 — jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) CVE-2018-1048 — undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser CVE-2018-5968 — jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)