Red Hat Security Advisory

RHSA-2017:3355

Red Hat JBoss BPM Suite 6.4.7 security update

Released 2017-11-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat JBoss BPMS 6.4

Fixes 2 records

TI-2017-03638 CVE-2017-5637 · GHSA-7cwj-j333-x7f7

Missing authentication in Apache ZooKeeper

HIGH 71

Two four letter word commands "wchp/wchc" are CPU intensive and could cause spike of CPU utilization on Apache ZooKeeper server if abused, which leads to the server unable to serve legitimate client requests.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.73064 Published 2017-10-10 Partial fix · 3.4.10, 3.5.3 CWE-306

TI-2017-05186 CVE-2017-7545 · GHSA-vc3x-72q4-g3p5

XML external entity injection in KIE jbpm-designer

LOW 34

It was discovered that the XmlUtils class in jbpmmigration 6.5 performed expansion of external parameter entities while parsing XML files.

CVSS 3.0MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02744 Published 2018-07-26 Partial fix CWE-611