Red Hat Security Advisory

RHSA-2018:0268

Red Hat JBoss Enterprise Application Platform 6.4.19 security update

Released 2018-02-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server hornetq-2.3.25-25.SP23_redhat_1.1.ep6.el7, infinispan-5.2.23-1.Final_redhat_1.1.ep6.el7, infinispan-cachestore-jdbc-5.2.23-1.Final_redhat_1.1.ep6.el7 +47

Fixes 3 records

TI-2017-09342 CVE-2017-12617 · GHSA-xjgh-84hx-56c5

Unrestricted file upload in Apache Tomcat

CRITICAL 94KEV

When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.99968 Published 2017-10-03 Partial fix · 9.0.1, 8.5.23 +2 CWE-434

TI-2018-00962 CVE-2018-1041 · GHSA-r69p-rc7c-rr2m

Infinite loop in Red Hat jboss-remoting

MEDIUM 49

A vulnerability was found in the way RemoteMessageChannel, introduced in jboss-remoting versions 3.3.10, reads from an empty buffer.

CVSS 3.0HIGH 7.5 Network No auth No interaction EPSS 0.15529 Published 2018-02-15 Fixed CWE-835

TI-2017-08964 CVE-2017-12174 · GHSA-gc96-h5pr-839j

Uncontrolled resource consumption in Red Hat HornetQ/Artemis

MEDIUM 42

It was found that when Artemis and HornetQ before 2.4.0 are configured with UDP discovery and JGroups discovery a huge byte array is created when receiving an unexpected multicast message.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.05976 Published 2018-03-07 Fixed in 2.4.0, 2.4.0.Final CWE-400