[RHSA-2018:2740-01] Important: Red Hat JBoss Enterprise Application Platform 6.4.21 security update

Mon Sep 24 21:47:13 UTC 2018

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Enterprise Application Platform 6.4.21 security update
Advisory ID:       RHSA-2018:2740-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2740
Issue date:        2018-09-24
CVE Names:         CVE-2017-2582 CVE-2017-7536 CVE-2018-1336 
                   CVE-2018-10237 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Enterprise Application
Platform 6.4 for Red Hat Enterprise Linux.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.

This release of Red Hat JBoss Enterprise Application Platform 6.4.21 serves
as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.20,
and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.

Security Fix(es):

* hibernate-validator: Privilege escalation when running under the security
manager (CVE-2017-7536)

* guava: Unbounded memory allocation in AtomicDoubleArray and
CompoundOrdering classes allow remote attackers to cause a denial of
service (CVE-2018-10237)

* picketlink: The fix for CVE-2017-2582 breaks the feature of attribute
replacement with system property in picketlink.xml (CVE-2017-2582)

* jbossweb: tomcat: A bug in the UTF-8 decoder can lead to DoS
(CVE-2018-1336)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

The CVE-2017-2582 issue was discovered by Hynek Mlnarik (Red Hat) and the
CVE-2017-7536 issue was discovered by Gunnar Morling (Red Hat).

3. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1261190 - [GSS](6.4.z) Upgrade jboss-ejb-client from 1.0.40 to 1.0.41
1410481 - CVE-2017-2582 picketlink, keycloak: SAML request parser replaces special strings with system properties
1465573 - CVE-2017-7536 hibernate-validator: Privilege escalation when running under the security manager
1570200 - [GSS](6.4.z) Upgrade JBoss Modules from 1.3.10 to 1.3.11
1573391 - CVE-2018-10237 guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service
1578830 - (6.4.z) Upgrade hibernate-validator from 4.3.3 to 4.3.4
1580440 - [GSS](6.4.z) Upgrade xnio from 3.0.16 to 3.0.17
1594389 - [GSS](6.4.z) The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml
1602226 - [GSS](6.4.z) Upgrade xerces from 2.9.1.redhat-6 to 2.9.1.redhat-8
1606334 - [GSS](6.4.z) Upgrade JBoss VFS from 3.2.12 to 3.2.13
1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS
1610355 - [GSS](6.4.z) Upgrade HornetQ from 2.3.25.SP24 to 2.3.25.SP28
1610742 - [GSS](6.4.z) Upgrade JBoss Web from 7.5.28 to 7.5.29
1611770 - [GSS](6.4.z) Upgrade Ironjacamar from 1.0.41 to 1.0.42
1614448 - [GSS](6.4.z) Upgrade Jackson from 1.9.9.redhat-6 to 1.9.9.redhat-7
1615347 - [GSS](6.4.z) Upgrade PicketLink from 2.5.4.SP18-redhat-1 to 2.5.4.SP18-redhat-2
1615380 - [GSS](6.4.z) Upgrade Guava from 13.0.1.redhat-2 to 13.0.1.redhat-3

5. References:

https://access.redhat.com/security/cve/CVE-2017-2582
https://access.redhat.com/security/cve/CVE-2017-7536
https://access.redhat.com/security/cve/CVE-2018-1336
https://access.redhat.com/security/cve/CVE-2018-10237
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/6.4/
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4

6. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW6lbXtzjgjWX9erEAQgvuhAAmWjRjX6+cckdgzHrBqY86ABFz+T6rvhW
xKr+NPFA32mvWqSTs5Faasvp4E360/j1b3SGKb7xw9zeMubbyc8a0qdOyszxQ9VU
UcUgU0Yd5qOdipaqEKtKQIKwTR/px4Vx8PuFLoDfQ9VcTTCUS7061G6FBwmTD6Ur
iN2UMxIicJwORdTpcmLJyWWSzM5fXFlgua6cP3ybfZ3BJz1XfmBhVu4uXAZJbsdt
6MCslgIloWAhTo4CS/Wbnl0LTFrUrKxsNMCwRV8ZvtyYpBSiAh9R/dMtippcKfuN
AaEyvK1HYFe0tEvMXVgHullihFXS3+E9EhGhfYueuZCwcLmSk/Yk1/r2II7Ci1FX
ZnUTNxaK7FMXivFl5ln8m82B+icFEzdvZg61P8ARs6lRZTveVJ8j14AijtUPh+RL
ePPF+o1MKDZDavWXz7gv8B4cYFdmu3ZnyZAWt+OcGfdJ0AafitnlRbxhIjOrMT9/
HQUfLULPMsG5WKmAOezKsrwDEAtQ27TBeoB0kDz2eJoFYOJ2ebtJpy87D6Omc+zF
hT1IDlGJfCc4x79GlEcShzJrCF8k6kpXzEPbqj/jQmPRV0pwK8yP7Ji1PTZmjXM4
WadUl98BuLTTh5wiF18Am3ag9cWuhCA6x1BCV9teTJiLBilYwOGHW2Pi+pSM8krT
VJ9QX/0XtOQ=
=Kz1/
-----END PGP SIGNATURE-----