SB2018051427 - Red Hat update for jboss
Published: May 14, 2018 Updated: May 24, 2018
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Deserialization of untrusted data (CVE-ID: CVE-2016-4978)
The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.The weakness exists in the getObject method of the javax.jms.ObjectMessage class in the (1) JMS Core client, (2) Artemis broker, and (3) Artemis REST component due to deserialization of untrusted data. A remote attacker with permission to send messages to the Artemis broker can deserialize arbitrary objects and execute arbitrary code by leveraging gadget classes being present on the Artemis classpath.
Successful exploitation of the vulnerability may result in system compromise.
2) Path traversal (CVE-ID: CVE-2017-3163)
The vulnerability allows a remote attacker to obtain potentially sensitive information on the atrget system.The weakness exists the Index Replication feature due to pulling index files from a master/leader node using an HTTP API which accepts a file name and improper validation of the file name. A remote attacker can submit a specially crafted special request, conduct path traversal attack, leaving any file readable to the Solr server process exposed.
3) Remote code execution (CVE-ID: CVE-2017-15095)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists in the jackson-databind development library due to improper implementation of blacklists for input handled by the ObjectMapper object readValue method. A remote unauthenticated attacker can send a malicious input and execute arbitrary code with elevated privileges.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
4) Deserialization of untrusted data (CVE-ID: CVE-2017-17485)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists in the FasterXML jackson-databind library due to improper validation of user-input handled by the readValue method of the ObjectMapper object. A remote attacker can send malicious input to the vulnerable method of a web application that uses the Spring library in the application's classpath and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
5) Security restrictions bypass (CVE-ID: CVE-2018-1304)
The vulnerability allows a remote attacker to bypass security restrictions on the target system.The weakness exists due to the URL pattern of "" (the empty string) which exactly maps to the context root was not correctly handled when used as part of a security constraint definition. A remote attacker can supply a specially crafted URL, bypass security restrictions and gain unauthorised access to web application resources.
6) Deserialization of untrusted data (CVE-ID: CVE-2018-7489)
The vulnerability allows a remote unauthenticated attacker to bypass security restrictions and execute arbitrary code on the target system.The weakness exists in the readValue method due to improper validation of user-input. A remote attacker can send malicious JSON input, bypass security restrictions and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
7) Improper access control (CVE-ID: CVE-2018-8088)
The vulnerability allows a remote unauthenticated attacker to bypass access restrictions on the target system.The weakness exists in the org.slf4j.ext.EventData class due to improper security restrictions. A remote attacker can send specially crafted input, bypass access restrictions and gain unauthorized access to perform further attacks.
8) Deserialization of untrusted data (CVE-ID: CVE-2017-7525)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.The weakness exists due to a deserialization flaw in the jackson-databind component. A remote attacker can send a specially crafted input to the readValue method of the ObjectMapper and execute arbitrary code with privileges of the target service.
Successful exploitation of the vulnerability may result in system compromise.
Remediation
Install update from vendor's website.