RHSA-2019:2998HighCVSS 9.8

Red Hat Security Advisory: Red Hat OpenShift Application Runtimes Thorntail 2.5.0 security & bug fix update

Published
October 10, 2019
Last Modified
August 4, 2026

🔗 CVE IDs covered (7)

CVE-2019-14379 →CVE-2019-3868 →CVE-2019-3888 →CVE-2019-10184 →CVE-2019-10212 →CVE-2019-12086 →CVE-2019-12384 →

📋 Description

CVE-2019-3868 — keycloak: session hijack using the user access token CVE-2019-3888 — undertow: leak credentials to log files UndertowLogger.REQUEST_LOGGER.undertowRequestFailed CVE-2019-10184 — undertow: Information leak in requests for directories without trailing slashes CVE-2019-10212 — undertow: DEBUG log for io.undertow.request.security if enabled leaks credentials to log files CVE-2019-12086 — jackson-databind: polymorphic typing issue allows attacker to read arbitrary local files on the server. CVE-2019-12384 — jackson-databind: failure to block the logback-core class from polymorphic deserialization leading to remote code execution CVE-2019-14379 — jackson-databind: default typing mishandling leading to remote code execution

🎯 Affected products1

  • Text-Only RHOAR

✅ Remediation

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: Use Elytron instead of legacy Security subsystem. Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

🔗 References (12)