(RHSA-2019:3892) Important: Red Hat Fuse 7.5.0 security update

This release of Red Hat Fuse 7.5.0 serves as a replacement for Red Hat Fuse 7.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es):

• jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095)

• jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) (CVE-2017-17485)

• infinispan: deserialization of data in XML and JSON transcoders (CVE-2018-1131)

• hadoop: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file (CVE-2018-8009)

• jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis (CVE-2018-11307)

• jackson-databind: improper polymorphic deserialization of types from Jodd-db library (CVE-2018-12022)

• jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver (CVE-2018-12023)

• jackson-databind: arbitrary code execution in slf4j-ext class (CVE-2018-14718)

• jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes (CVE-2018-14719)

• jackson-databind: exfiltration/XXE in some JDK classes (CVE-2018-14720)

• jackson-databind: improper polymorphic deserialization in axis2-transport-jms class (CVE-2018-19360)

• jackson-databind: improper polymorphic deserialization in openjpa class (CVE-2018-19361)

• jackson-databind: improper polymorphic deserialization in jboss-common-core class (CVE-2018-19362)

• retrofit: Directory traversal in RequestBuilder allows manipulation of resources (CVE-2018-1000850)

• zookeeper: Information disclosure in Apache ZooKeeper (CVE-2019-0201)

• mesos: docker image code execution (CVE-2019-0204)

• netty: HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

• grpc: HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

• netty: HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

• grpc: HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

• netty: HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

• grpc: HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

• netty: HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

• xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285) (CVE-2019-10173)

• syndesis: default CORS configuration is allow all (CVE-2019-14860)

• netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers (CVE-2019-16869)

• activemq: ActiveMQ Client Missing TLS Hostname Verification (CVE-2018-11775)

• tika: Incomplete fix allows for XML entity expansion resulting in denial of service (CVE-2018-11796)

• jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class (CVE-2018-14721)

• tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.