Red Hat Security Advisory

RHSA-2017:2635

Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6

Released 2017-09-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el6, codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el6, codehaus-jackson-core-asl-1.9.9-11.redhat_5.1.ep6.el6 +47

Fixes 3 records

TI-2017-03645 CVE-2017-5645 · GHSA-fxph-q3j8-mv87

Deserialization of untrusted data in Apache Log4j

CRITICAL 91

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, c…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.89358 Published 2017-04-17 Partial fix · 2.8.2 CWE-502

TI-2017-05167 CVE-2017-7525 · GHSA-qxxx-2pp7-5hmx

Deserialization of untrusted data in FasterXML jackson-databind

HIGH 75

A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to perform code execution by sending the maliciously crafted input to t…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.37721 Published 2018-02-06 Partial fix · 2.6.7.1, 2.7.9.1 +1 CWE-184

TI-2017-03664 CVE-2017-5664 · GHSA-jmvv-524f-hj5j

Improper handling of exceptional conditions in Apache Tomcat

MEDIUM 56

The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error that occurred, the original request and response are forwarded to the error pag…

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.16567 Published 2017-06-06 Partial fix · 9.0.0.M21, 8.5.15 +2 CWE-755