(RHSA-2019:3140) Important: Red Hat JBoss Data Virtualization 6.4.8 security update

Red Hat JBoss Data Virtualization is a lean data integration solution that provides easy, real-time, and unified data access across disparate sources to multiple applications and users. JBoss Data Virtualization makes data spread across physically distinct systems - such as multiple databases, XML files, and even Hadoop systems - appear as a set of tables in a local database.

This release of Red Hat JBoss Data Virtualization 6.4.8 serves as a replacement for Red Hat JBoss Data Virtualization 6.4.7, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es):

• thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands (CVE-2016-5397)

• tika-core: tika: Command injection in tika-server can allow remote attackers to execute arbitrary commands via crafted headers (CVE-2018-1335)

• slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)

• jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis (CVE-2018-11307)

• libthrift: thrift: Improper Access Control grants access to files outside the webservers docroot path (CVE-2018-11798)

• jackson-databind: improper polymorphic deserialization of types from Jodd-db library (CVE-2018-12022)

• jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver (CVE-2018-12023)

• jackson-databind: arbitrary code execution in slf4j-ext class (CVE-2018-14718)

• jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes (CVE-2018-14719)

• jackson-databind: improper polymorphic deserialization in axis2-transport-jms class (CVE-2018-19360)

• jackson-databind: improper polymorphic deserialization in openjpa class (CVE-2018-19361)

• jackson-databind: improper polymorphic deserialization in jboss-common-core class (CVE-2018-19362)

• zookeeper: Information disclosure in Apache ZooKeeper (CVE-2019-0201)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.