Red Hat Security Advisory: Red Hat support for Spring Boot 2.1.15 security and bug fix update
🔗 CVE IDs covered (2)
📋 Description
CVE-2020-1714 — keycloak: Lack of checks in ObjectInputStream leading to Remote Code Execution CVE-2020-9484 — tomcat: deserialization flaw in session persistence storage leading to RCE
🎯 Affected products1
- Red Hat Runtimes Spring Boot 2.1.15
✅ Remediation
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. The References section of this erratum contains a download link (you must log in to download the update). Workaround: There is currently no known mitigation for this issue. Workaround: Users may configure the PersistenceManager with an appropriate value for sessionAttributeValueClassNameFilter to ensure that only application provided attributes are serialized and deserialized. For more details about the configuration, refer to the Apache Tomcat 9 Configuration Reference https://tomcat.apache.org/tomcat-9.0-doc/config/manager.html.
🔗 References (7)
- selfhttps://access.redhat.com/errata/RHSA-2020:3017
- externalhttps://access.redhat.com/security/updates/classification/#important
- externalhttps://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.spring.boot&version=2.1.15
- externalhttps://access.redhat.com/documentation/en-us/red_hat_support_for_spring_boot/2.1/html-single/release_notes_for_spring_boot_2.1/index
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1705975
- externalhttps://bugzilla.redhat.com/show_bug.cgi?id=1838332
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3017.json