Lucene search

K
redhatRedHatRHSA-2019:3892
HistoryNov 14, 2019 - 9:15 p.m.

(RHSA-2019:3892) Important: Red Hat Fuse 7.5.0 security update

2019-11-1421:15:16
access.redhat.com
101

0.942 High

EPSS

Percentile

99.2%

This release of Red Hat Fuse 7.5.0 serves as a replacement for Red Hat Fuse 7.4, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es):

  • jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095)

  • jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) (CVE-2017-17485)

  • infinispan: deserialization of data in XML and JSON transcoders (CVE-2018-1131)

  • hadoop: arbitrary file write vulnerability / arbitrary code execution using a specially crafted zip file (CVE-2018-8009)

  • jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis (CVE-2018-11307)

  • jackson-databind: improper polymorphic deserialization of types from Jodd-db library (CVE-2018-12022)

  • jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver (CVE-2018-12023)

  • jackson-databind: arbitrary code execution in slf4j-ext class (CVE-2018-14718)

  • jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes (CVE-2018-14719)

  • jackson-databind: exfiltration/XXE in some JDK classes (CVE-2018-14720)

  • jackson-databind: improper polymorphic deserialization in axis2-transport-jms class (CVE-2018-19360)

  • jackson-databind: improper polymorphic deserialization in openjpa class (CVE-2018-19361)

  • jackson-databind: improper polymorphic deserialization in jboss-common-core class (CVE-2018-19362)

  • retrofit: Directory traversal in RequestBuilder allows manipulation of resources (CVE-2018-1000850)

  • zookeeper: Information disclosure in Apache ZooKeeper (CVE-2019-0201)

  • mesos: docker image code execution (CVE-2019-0204)

  • netty: HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  • grpc: HTTP/2: flood using PING frames results in unbounded memory growth (CVE-2019-9512)

  • netty: HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  • grpc: HTTP/2: flood using HEADERS frames results in unbounded memory growth (CVE-2019-9514)

  • netty: HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

  • grpc: HTTP/2: flood using SETTINGS frames results in unbounded memory growth (CVE-2019-9515)

  • netty: HTTP/2: flood using empty frames results in excessive resource consumption (CVE-2019-9518)

  • xstream: remote code execution due to insecure XML deserialization (regression of CVE-2013-7285) (CVE-2019-10173)

  • syndesis: default CORS configuration is allow all (CVE-2019-14860)

  • netty: HTTP request smuggling by mishandled whitespace before the colon in HTTP headers (CVE-2019-16869)

  • activemq: ActiveMQ Client Missing TLS Hostname Verification (CVE-2018-11775)

  • tika: Incomplete fix allows for XML entity expansion resulting in denial of service (CVE-2018-11796)

  • jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class (CVE-2018-14721)

  • tomcat: Host name verification missing in WebSocket client (CVE-2018-8034)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.