RHSA-2018:0481HighCVSS 8.6

Red Hat Security Advisory: jboss-ec2-eap package for EAP 7.1.1

Published
March 12, 2018
Last Modified
August 4, 2026

🔗 CVE IDs covered (8)

CVE-2017-17485 →CVE-2018-1048 →CVE-2018-5968 →CVE-2017-7561 →CVE-2017-12174 →CVE-2017-12196 →CVE-2017-15089 →CVE-2017-15095 →

📋 Description

CVE-2017-7561 — resteasy: Vary header not added by CORS filter leading to cache poisoning CVE-2017-12174 — artemis/hornetq: memory exhaustion via UDP and JGroups discovery CVE-2017-12196 — undertow: Client can use bogus uri in Digest authentication CVE-2017-15089 — infinispan: Unsafe deserialization of malicious object injected into data cache CVE-2017-15095 — jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) CVE-2017-17485 — jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) CVE-2018-1048 — undertow: ALLOW_ENCODED_SLASH option not taken into account in the AjpRequestParser CVE-2018-5968 — jackson-databind: unsafe deserialization due to incomplete blacklist (incomplete fix for CVE-2017-7525 and CVE-2017-17485)

🎯 Affected products8

  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-jboss-ec2-eap-0:7.1.1-3.1.GA_redhat_3.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-jboss-ec2-eap-0:7.1.1-3.1.GA_redhat_3.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-jboss-ec2-eap-0:7.1.1-3.1.GA_redhat_3.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-jboss-ec2-eap-0:7.1.1-3.1.GA_redhat_3.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-jboss-ec2-eap-samples-0:7.1.1-3.1.GA_redhat_3.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-jboss-ec2-eap-samples-0:7.1.1-3.1.GA_redhat_3.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: Mitigation to this problem is to not trigger polymorphic desrialization globally by using: objectMapper.enableDefaultTyping() and rather use @JsonTypeInfo on the class property to explicitly define the type information. For more information on this issue please refer to https://www.github.com/mbechler/marshalsec/blob/master/marshalsec.pdf?raw=true

🔗 References (13)