Red Hat Security Advisory

RHSA-2019:2936

Red Hat JBoss Enterprise Application Platform 7.2.4 on RHEL 7 security update

Released 2019-10-01 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat JBoss EAP 7.2 for RHEL 7 Server eap7-activemq-artemis-2.9.0-1.redhat_00005.1.el7eap, eap7-activemq-artemis-cli-2.9.0-1.redhat_00005.1.el7eap, eap7-activemq-artemis-commons-2.9.0-1.redhat_00005.1.el7eap +47

Fixes 7 records

TI-2019-09232 CVE-2019-12384 · GHSA-mph4-vhrx-mv67

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of…

MEDIUM 62

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.45205 Published 2019-06-24 Partial fix · 2.9.9.1, 2.8.11.4 +2 CWE-502

TI-2019-10718 CVE-2019-14379 · GHSA-6fpp-rgj9-8rwc

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default…

MEDIUM 60

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code ex…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08111 Published 2019-07-29 Partial fix · 2.9.9.2, 2.8.11.4 +1 CWE-1321

TI-2019-09017 CVE-2019-12086 · GHSA-5ww9-j83m-q7qx

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.

MEDIUM 58

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.21949 Published 2019-05-17 Partial fix · 2.9.9, 2.8.11.4 +2 CWE-502

TI-2019-07523 CVE-2019-10202 · GHSA-c27h-mcmw-48hv

Deserialization of untrusted data in Red Hat codehaus

MEDIUM 50

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05175 Published 2019-10-01 Partial fix CWE-502

TI-2019-07532 CVE-2019-10212 · GHSA-8vh8-vc28-m2hf

Sensitive information in log files in Red Hat undertow

MEDIUM 46

A flaw was found in, all under 2.0.20, in the Undertow DEBUG log for io.undertow.request.security.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01892 Published 2019-10-02 Partial fix · 2.0.20 CWE-532

TI-2019-09596 CVE-2019-12814 · GHSA-cmfg-87vq-g5g4

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9.

LOW 39

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.10902 Published 2019-06-19 Partial fix · 2.9.9.1, 2.8.11.4 +2 CWE-502

TI-2019-07505 CVE-2019-10184 · GHSA-w69w-jvc7-wjgv

Missing authorization in undertow-io undertow

LOW 39

undertow before version 2.0.23.Final is vulnerable to an information leak issue.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03478 Published 2019-07-25 Partial fix · 2.0.23 CWE-862