RHSA-2018:1249HighCVSS 8.6

Red Hat Security Advisory: jboss-ec2-eap package for EAP 7.1.2

Published
April 25, 2018
Last Modified
August 4, 2026

🔗 CVE IDs covered (3)

CVE-2018-1047 →CVE-2018-1067 →CVE-2018-8088 →

📋 Description

CVE-2018-1047 — undertow: Path traversal in ServletResourceManager class CVE-2018-1067 — undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993) CVE-2018-8088 — slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution

🎯 Affected products8

  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-jboss-ec2-eap-0:7.1.2-1.GA_redhat_1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-jboss-ec2-eap-0:7.1.2-1.GA_redhat_1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-jboss-ec2-eap-0:7.1.2-1.GA_redhat_1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-jboss-ec2-eap-0:7.1.2-1.GA_redhat_1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server
  • eap7-jboss-ec2-eap-samples-0:7.1.2-1.GA_redhat_1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server
  • eap7-jboss-ec2-eap-samples-0:7.1.2-1.GA_redhat_1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258

🔗 References (8)