RHSA-2019:2938HighCVSS 9.8

Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.2.4 security update

Published
September 30, 2019
Last Modified
August 4, 2026

🔗 CVE IDs covered (8)

CVE-2019-12384 →CVE-2019-12814 →CVE-2019-14379 →CVE-2019-19343 →CVE-2019-10184 →CVE-2019-10202 →CVE-2019-10212 →CVE-2019-12086 →

📋 Description

CVE-2019-10184 — undertow: Information leak in requests for directories without trailing slashes CVE-2019-10202 — codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities CVE-2019-10212 — undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files CVE-2019-12086 — jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. CVE-2019-12384 — jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution CVE-2019-12814 — jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server via crafted JSON message. CVE-2019-14379 — jackson-databind: default typing mishandling leading to remote code execution CVE-2019-19343 — Undertow: Memory Leak in Undertow HttpOpenListener due to holding remoting connections indefinitely

🎯 Affected products1

  • Red Hat JBoss EAP 7.2

✅ Remediation

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). The JBoss server process must be restarted for the update to take effect. Workaround: Use Elytron instead of legacy Security subsystem. Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: This vulnerability relies on jdom (org.jdom) or jdom2 (org.jdom2) being present in the application's ClassPath. Applications using jackson-databind that do not also use jdom or jdom2 are not impacted by this vulnerability. Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

🔗 References (39)