RHSA-2020:3779HighCVSS 9.8

Red Hat Security Advisory: Red Hat Data Grid 7.3.7 security update

Published
September 17, 2020
Last Modified
August 4, 2026

🔗 CVE IDs covered (26)

CVE-2020-11612 →CVE-2020-11619 →CVE-2017-7658 →CVE-2020-1745 →CVE-2020-1757 →CVE-2020-9548 →CVE-2020-10969 →CVE-2017-7657 →CVE-2020-1695 →CVE-2020-1710 →CVE-2020-8840 →CVE-2020-10672 →CVE-2020-10673 →CVE-2020-11111 →CVE-2020-11620 →CVE-2017-7656 →CVE-2020-1748 →CVE-2020-10714 →CVE-2020-10968 →CVE-2020-11113 →CVE-2019-10172 →CVE-2020-1719 →CVE-2020-9488 →CVE-2020-9546 →CVE-2020-9547 →CVE-2020-11112 →

📋 Description

CVE-2017-7656 — jetty: HTTP request smuggling using the range header CVE-2017-7657 — jetty: HTTP request smuggling CVE-2017-7658 — jetty: Incorrect header handling CVE-2019-10172 — jackson-mapper-asl: XML external entity similar to CVE-2016-3720 CVE-2020-1695 — resteasy: Improper validation of response header in MediaTypeHeaderDelegate.java class CVE-2020-1710 — EAP: field-name is not parsed in accordance to RFC7230 CVE-2020-1719 — Wildfly: EJBContext principal is not popped back after invoking another EJB using a different Security Domain CVE-2020-1745 — undertow: AJP File Read/Inclusion Vulnerability CVE-2020-1748 — Wildfly: Improper authorization issue in WildFlySecurityManager when using alternative protection domain CVE-2020-1757 — undertow: servletPath is normalized incorrectly leading to dangerous application mapping which could result in security bypass CVE-2020-8840 — jackson-databind: Lacks certain xbean-reflect/JNDI blocking CVE-2020-9488 — log4j: improper validation of certificate with host mismatch in SMTP appender CVE-2020-9546 — jackson-databind: Serialization gadgets in shaded-hikari-config CVE-2020-9547 — jackson-databind: Serialization gadgets in ibatis-sqlmap CVE-2020-9548 — jackson-databind: Serialization gadgets in anteros-core CVE-2020-10672 — jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution CVE-2020-10673 — jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution CVE-2020-10714 — wildfly-elytron: session fixation when using FORM authentication CVE-2020-10968 — jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider CVE-2020-10969 — jackson-databind: Serialization gadgets in javax.swing.JEditorPane CVE-2020-11111 — jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory CVE-2020-11112 — jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider CVE-2020-11113 — jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime CVE-2020-11612 — netty: compression/decompression codecs don't enforce limits on buffer allocation sizes CVE-2020-11619 — jackson-databind: Serialization gadgets in org.springframework:spring-aop CVE-2020-11620 — jackson-databind: Serialization gadgets in commons-jelly:commons-jelly

🎯 Affected products1

  • Red Hat Data Grid 7.3.7

✅ Remediation

To install this update, do the following: 1. Download the Data Grid 7.3.7 server patch from the customer portal. See the download link in the References section. 2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on. 3. Install the Data Grid 7.3.7 server patch. Refer to the 7.3 Release Notes for patching instructions. 4. Restart Data Grid to ensure the changes take effect. Workaround: There is currently no known mitigation for this issue. Workaround: Please refer to the Red Hat knowledgebase article: https://access.redhat.com/solutions/4851251 Workaround: The issue can be mitigated by configuring UrlPathHelper to ignore the servletPath via setting "alwaysUseFullPath". Workaround: Previous versions can set the system property mail.smtp.ssl.checkserveridentity to true to globally enable hostname verification for SMTPS connections. Workaround: This attack is dependent on the attacker being able to create a session and the victim accessing the session before the session expires, we do have a 15 minute session timeout by default but the attacker could also keep this alive by say sending in a request every five minutes. The server by default supports session tracking by URL and Cookie, if the web.xml is updated to support COOKIE only the exploit is not possible by sharing the link. ~~~ <session-config> <tracking-mode>URL</tracking-mode> </session-config> ~~~ TO ~~~ <session-config> <tracking-mode>COOKIE</tracking-mode> </session-config> ~~~ Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS` Workaround: The following conditions are needed for an exploit, we recommend avoiding all if possible: * Deserialization from sources you do not control * `enableDefaultTyping()` * `@JsonTypeInfo using `id.CLASS` or `id.MINIMAL_CLASS`

🔗 References (29)