(RHSA-2019:0137) Moderate: Red Hat JBoss Enterprise Application Platform 7.2.0 security update

2019-01-2216:19:19

access.redhat.com

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

0.002 Low

EPSS

Percentile

55.0%

JSON

This enhancement adds the new Red Hat JBoss Enterprise Application Platform 7.2.0 packages to Red Hat Enterprise Linux 7.

This release serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.1, and includes bug fixes and enhancements. Refer to the Red Hat JBoss Enterprise Application Platform 7.2.0 Release Notes for information on the most significant bug fixes and enhancements included in this release.

All users of Red Hat JBoss Enterprise Application Platform 7.1 on Red Hat
Enterprise Linux 7 are advised to upgrade to these updated packages. The JBoss server process must be restarted for the update to take effect.

Security Fix(es):

picketlink: picketlink-bindings: The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml (CVE-2017-2582)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

The CVE-2017-2582 issue was discovered by Hynek Mlnarik (Red Hat).

OSVersionArchitecturePackageVersionFilename
RedHat7noarcheap7-javassist< 3.23.1-1.GA_redhat_00001.1.el7eapeap7-javassist-3.23.1-1.GA_redhat_00001.1.el7eap.noarch.rpm
RedHat7noarcheap7-cxf-xjc-runtime< 3.2.2-1.redhat_00001.1.el7eapeap7-cxf-xjc-runtime-3.2.2-1.redhat_00001.1.el7eap.noarch.rpm
RedHat7noarcheap7-resteasy-client< 3.6.1-3.SP2_redhat_00001.1.el7eapeap7-resteasy-client-3.6.1-3.SP2_redhat_00001.1.el7eap.noarch.rpm
RedHat7noarcheap7-hornetq-jms-client< 2.4.7-5.Final_redhat_1.1.el7eapeap7-hornetq-jms-client-2.4.7-5.Final_redhat_1.1.el7eap.noarch.rpm
RedHat7noarcheap7-bouncycastle-mail< 1.60.0-1.redhat_00001.1.el7eapeap7-bouncycastle-mail-1.60.0-1.redhat_00001.1.el7eap.noarch.rpm
RedHat7noarcheap7-jackson-datatype-jdk8< 2.9.5-2.redhat_2.1.el7eapeap7-jackson-datatype-jdk8-2.9.5-2.redhat_2.1.el7eap.noarch.rpm
RedHat7noarcheap7-slf4j< 1.7.22-4.redhat_2.1.el7eapeap7-slf4j-1.7.22-4.redhat_2.1.el7eap.noarch.rpm
RedHat7noarcheap7-jbossws-cxf< 5.2.4-1.Final_redhat_00001.1.el7eapeap7-jbossws-cxf-5.2.4-1.Final_redhat_00001.1.el7eap.noarch.rpm
RedHat7noarcheap7-hibernate-core< 5.3.7-1.Final_redhat_00001.1.el7eapeap7-hibernate-core-5.3.7-1.Final_redhat_00001.1.el7eap.noarch.rpm
RedHat7noarcheap7-wss4j-bindings< 2.2.2-2.redhat_00002.1.el7eapeap7-wss4j-bindings-2.2.2-2.redhat_00002.1.el7eap.noarch.rpm

OS	Version	Architecture	Package	Version	Filename
RedHat	7	noarch	eap7-javassist	< 3.23.1-1.GA_redhat_00001.1.el7eap	eap7-javassist-3.23.1-1.GA_redhat_00001.1.el7eap.noarch.rpm
RedHat	7	noarch	eap7-cxf-xjc-runtime	< 3.2.2-1.redhat_00001.1.el7eap	eap7-cxf-xjc-runtime-3.2.2-1.redhat_00001.1.el7eap.noarch.rpm
RedHat	7	noarch	eap7-resteasy-client	< 3.6.1-3.SP2_redhat_00001.1.el7eap	eap7-resteasy-client-3.6.1-3.SP2_redhat_00001.1.el7eap.noarch.rpm
RedHat	7	noarch	eap7-hornetq-jms-client	< 2.4.7-5.Final_redhat_1.1.el7eap	eap7-hornetq-jms-client-2.4.7-5.Final_redhat_1.1.el7eap.noarch.rpm
RedHat	7	noarch	eap7-bouncycastle-mail	< 1.60.0-1.redhat_00001.1.el7eap	eap7-bouncycastle-mail-1.60.0-1.redhat_00001.1.el7eap.noarch.rpm
RedHat	7	noarch	eap7-jackson-datatype-jdk8	< 2.9.5-2.redhat_2.1.el7eap	eap7-jackson-datatype-jdk8-2.9.5-2.redhat_2.1.el7eap.noarch.rpm
RedHat	7	noarch	eap7-slf4j	< 1.7.22-4.redhat_2.1.el7eap	eap7-slf4j-1.7.22-4.redhat_2.1.el7eap.noarch.rpm
RedHat	7	noarch	eap7-jbossws-cxf	< 5.2.4-1.Final_redhat_00001.1.el7eap	eap7-jbossws-cxf-5.2.4-1.Final_redhat_00001.1.el7eap.noarch.rpm
RedHat	7	noarch	eap7-hibernate-core	< 5.3.7-1.Final_redhat_00001.1.el7eap	eap7-hibernate-core-5.3.7-1.Final_redhat_00001.1.el7eap.noarch.rpm
RedHat	7	noarch	eap7-wss4j-bindings	< 2.2.2-2.redhat_00002.1.el7eap	eap7-wss4j-bindings-2.2.2-2.redhat_00002.1.el7eap.noarch.rpm