[RHSA-2017:1097-01] Moderate: Red Hat JBoss Data Grid 7.1

[bugzilla at redhat.com]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: Red Hat JBoss Data Grid 7.1
Advisory ID:       RHSA-2017:1097-01
Product:           Red Hat JBoss Data Grid
Advisory URL:      https://rhn.redhat.com/errata/RHSA-2017-1097.html
Issue date:        2017-04-19
CVE Names:         CVE-2016-4970 CVE-2017-2638 
=====================================================================

1. Summary:

Red Hat JBoss Data Grid 7.1 is now available for download from the Customer
Portal.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Data Grid is a distributed in-memory data grid, based on
Infinispan.

This release of Red Hat JBoss Data Grid 7.1.0 serves as a replacement for
Red Hat JBoss Data Grid 7.0.0, and includes bug fixes and enhancements,
which are documented in the Release Notes linked to in the References.

Security Fix(es):

* An infinite-loop vulnerability was discovered in Netty's OpenSslEngine
handling of renegotiation. An attacker could exploit this flaw to cause a
denial of service. Note: Netty is only vulnerable if renegotiation is
enabled (default setting). (CVE-2016-4970)

* It was found that the REST API in infinispan did not properly enforce
auth constraints. An attacker could use this vulnerability to read or
modify data in the default cache or a known cache name. (CVE-2017-2638)

The CVE-2017-2638 issue was discovered by Jonathan Mason (Red Hat).

3. Solution:

The References section of this erratum contains a download link (you must
log in to download the update).

Before applying the update, back up your existing Red Hat JBoss Data Grid
installation (including databases, configuration files, and so on).

4. Bugs fixed (https://bugzilla.redhat.com/):

1343616 - CVE-2016-4970 netty: Infinite loop vulnerability when handling renegotiation using SslProvider.OpenSsl
1428564 - CVE-2017-2638 infinispan: auth bypass in REST api

5. References:

https://access.redhat.com/security/cve/CVE-2016-4970
https://access.redhat.com/security/cve/CVE-2017-2638
https://access.redhat.com/security/updates/classification/#moderate
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.grid&downloadType=distributions&version=7.1.0
https://access.redhat.com/documentation/en-US/Red_Hat_JBoss_Data_Grid/

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFY96OiXlSAg2UNWIIRAmwFAKCApaIF/7TCynlaeAZUyCIWJSnLJACfVyiD
lyaUKhTBIUY6iu5upM0c6nk=
=C6Iu
-----END PGP SIGNATURE-----