Red Hat Security AdvisoryRHSA-2018:2090
Red Hat JBoss Enterprise Application Platform security update
Released 2018-06-27 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server eap7-activemq-artemis-1.5.5.012-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-cli-1.5.5.012-1.redhat_1.1.ep7.el6, eap7-activemq-artemis-commons-1.5.5.012-1.redhat_1.1.ep7.el6 +47
Fixes 2 records
Priority HIGH 67
FasterXML jackson-databind before 2.7.9.3, 2.8.x before 2.8.11.1 and 2.9.x before 2.9.5 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.19781 · Published 2018-02-26 · Partial fix · 2.8.11.1, 2.9.5 +2 CWE-184
Priority LOW 33
It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to exhaust.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02329 · Published 2018-09-11 · Partial fix · 1.4.25.Final, 2.0.5.Final CWE-400
