Red Hat Security Advisory

RHSA-2018:2930

Red Hat JBoss Operations Network 3.3.11 security and bug fix update

Released 2018-10-16 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss Operations Network 3.3

Fixes 4 records

TI-2017-12774 CVE-2017-17485 · GHSA-rfx6-vp9g-rh7v

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated…

HIGH 80

FasterXML jackson-databind through 2.8.10 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 deserialization flaw.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.49727 Published 2018-01-10 Partial fix · 2.9.4, 2.8.11 +1 CWE-502

TI-2018-08993 CVE-2018-12533 · GHSA-4j38-wjhf-884r

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject…

MEDIUM 60

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language (EL) expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.…

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.18681 Published 2018-06-18 Partial fix CWE-917

TI-2018-05845 CVE-2018-8088 · GHSA-w77p-8cfg-2x43

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows…

MEDIUM 58

org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.14703 Published 2018-03-20 Partial fix · 1.7.26, 1.8.0-beta4 CWE-284

TI-2018-01237 CVE-2018-1336 · GHSA-m59c-jpc8-m2x4

Infinite loop in Apache Tomcat

MEDIUM 58

An improper handing of overflow in the UTF-8 decoder with supplementary characters can lead to an infinite loop in the decoder causing a Denial of Service.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.20354 Published 2018-08-02 Partial fix · 9.0.8, 8.5.31 +2 CWE-835