Multiple vulnerabilities in Fuse 7

1) Unsafe reflection

EUVDB-ID: #VU65653

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:A/U:Green]

CVE-ID: CVE-2014-0114

CWE-ID: CWE-470 - Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')

Exploit availability: Yes

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to Apache Commons BeanUtils does not suppress the class property. A remote unauthenticated attacker can manipulate the ClassLoader and execute arbitrary code via the class parameter

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.

2) Command injection

EUVDB-ID: #VU11178

Risk: High

CVSSv4.0: 7.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:U/U:Amber]

CVE-ID: CVE-2016-5397

CWE-ID: CWE-77 - Command injection

Exploit availability: No

The vulnerability allows a remote authenticated attacker to execute arbitrary code on the target system.

The weakness exists in the ft_go_generator.cc:format_go_output()function due to command injection. A remote attacker can submit a specially crafted service name through an external formatting tool and execute arbitrary code.

Successful exploitation of the vulnerability may result in system compromise.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Improper verification of cryptographic signature

EUVDB-ID: #VU13586

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1000338

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

The vulnerability allows a remote attacker to bypass signature validation process.

The JCE Provider in Bouncy Castle does not fully validate ASN.1 encoding of signature on verification within DSA implementation. A remote attacker can inject extra elements in the sequence making up the signature, which will be considered valid allowing an attacker to add extra data into a signed structure.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Cryptographic issues

EUVDB-ID: #VU13587

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1000339

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability is present in Bouncy Castle JCE Provider due to usage of AESFastEngine that does not provide the sufficient level of secrecy and is prone to side-channel attacks. 

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Cryptographic issues

EUVDB-ID: #VU13588

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1000340

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists in Bouncy Castle JCE Provider due to buggy implementation of squaring for several raw math classes have been fixed (org.bouncycastle.math.raw.Nat???). These classes are used by our custom elliptic curve implementations (org.bouncycastle.math.ec.custom.**), so there was the possibility of rare (in general usage) spurious calculations for elliptic curve scalar multiplications. Such errors would have been detected with high probability by the output validation for our scalar multipliers.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Cryptographic issues

EUVDB-ID: #VU13589

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1000341

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists in Bouncy Castle JCE Provider implementation of DSA signature generation process. The attacker with ability to observe timings for the generation of signatures can gain information about the signature's k value and ultimately the private value as well.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Improper verification of cryptographic signature

EUVDB-ID: #VU13590

Risk: Low

CVSSv4.0: 1.3 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1000342

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

Exploit availability: No

The vulnerability allows a remote attacker to bypass signature validation process.

The JCE Provider in Bouncy Castle does not fully validate ASN.1 encoding of signature on verification within ECDSA implementation. A remote attacker can inject extra elements in the sequence making up the signature, which will be considered valid allowing an attacker to add extra data into a signed structure.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the local network (LAN).

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Cryptographic issues

EUVDB-ID: #VU13591

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1000343

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists in Bouncy Castle JCE Provider implementation of DSA key pair generator that generates a weak private key (1024 bit key size) if used with default values.  The attacker can use this vulnerability to decrypt data.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Cryptographic issues

EUVDB-ID: #VU86066

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-1000344

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to DHIES implementation allowed the use of ECB mode. A remote attacker can trigger the vulnerability to modify data on the system.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

10) Information disclosure

EUVDB-ID: #VU86069

Risk: Medium

CVSSv4.0: 4.8 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-1000345

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to DHIES/ECIES CBC mode vulnerable to padding oracle attack. A remote attacker with enough observations can identify when the decryption is failing due to padding.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

11) Key management errors

EUVDB-ID: #VU86068

Risk: Low

CVSSv4.0: 1.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-1000346

CWE-ID: CWE-320 - Key Management Errors

Exploit availability: No

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the other party DH public key is not fully validated.. A remote attacker can gain unauthorized access to sensitive information on the system and reveal details about the other party's private key where static Diffie-Hellman is in use.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

12) Cryptographic issues

EUVDB-ID: #VU86062

Risk: Medium

CVSSv4.0: 6.9 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-1000352

CWE-ID: CWE-310 - Cryptographic Issues

Exploit availability: No

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to ECIES implementation allowed the use of ECB mode. A remote attacker can trigger the vulnerability to bypass security restrictions and escalate privileges on the system.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

13) Input validation error

EUVDB-ID: #VU108785

Risk: High

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2017-14063

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to modify data on the system.

The vulnerability exists due to Async Http Client can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier. A remote attacker can pass specially crafted input to the application and modify data on the system.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

14) Memory leak

EUVDB-ID: #VU20069

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-1114

CWE-ID: CWE-401 - Missing release of memory after effective lifetime

Exploit availability: No

The vulnerability allows a remote attacker to perform DoS attack on the target system.

The vulnerability exists due memory leak in URLResource.getLastModified() function in Undertow due to the method closes file descriptors only when they are finalized. A remote attacker can initiate opening of numerous URLs and exhaust all file descriptors, leading to a denial of service (DoS) attack.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

15) Path traversal

EUVDB-ID: #VU11752

Risk: Low

CVSSv4.0: 8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1271

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Exploit availability: No

The vulnerability allows a remote unauthenticated attacker to obtain potentially sensitive information and write arbitrary files on the target system.

The weakness exists in the spring-webmvc module due to the improper serving of static resources from a file system on Microsoft Windows systems. A remote attacker can send a malicious request using a crafted URL, trigger directory traversal, overwrite, delete or read potentially sensitive file information.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

16) Improper privilege management

EUVDB-ID: #VU11753

Risk: Low

CVSSv4.0: 6.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1272

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: No

The vulnerability allows a remote authenticated attacker to gain elevated privileges on the target system.

The weakness exists due to improper processing of multipart requests. A remote attacker can make a multipart request that injects malicious content to the target server, cause it to use wrong values and gain root privileges.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

17) Infinite loop

EUVDB-ID: #VU37154

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-1338

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's BPGParser in versions of Apache Tika before 1.18.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

18) Infinite loop

EUVDB-ID: #VU37155

Risk: Medium

CVSSv4.0: 4.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-1339

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

A carefully crafted (or fuzzed) file can trigger an infinite loop in Apache Tika's ChmParser in versions of Apache Tika before 1.18.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

19) Infinite loop

EUVDB-ID: #VU13547

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-8036

CWE-ID: CWE-835 - Loop with Unreachable Exit Condition ('Infinite Loop')

Exploit availability: No

The vulnerability allows a remote attacker to cause DoS condition on the target system.

The weakness exists due to infinite loop when handling malicious input. A remote attacker can supple specially crafted (or fuzzed) file, trigger out of memory exception and cause the service to crash.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

20) Improper access control

EUVDB-ID: #VU11301

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-8088

CWE-ID: CWE-284 - Improper Access Control

Exploit availability: No

The vulnerability allows a remote unauthenticated attacker to bypass access restrictions on the target system.

The weakness exists in the org.slf4j.ext.EventData class due to improper security restrictions. A remote attacker can send specially crafted input, bypass access restrictions and gain unauthorized access to perform further attacks.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

21) Cross-site scripting

EUVDB-ID: #VU11151

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2018-1000129

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

The vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The weakness exists due to insufficient sanitization of user-supplied data. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

22) Remote code execution

EUVDB-ID: #VU11168

Risk: High

CVSSv4.0: 8.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2018-1000130

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists in the Java Naming and Directory Interface (JNDI) of Jolokia due to insufficient validation of user-supplied input. A remote attacker can inject and execute arbitrary Java code.

Successful exploitation of the vulnerability may result in system compromise.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

23) Improper input validation

EUVDB-ID: #VU27043

Risk: Medium

CVSSv4.0: 6.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2018-1000180

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.

The vulnerability exists due to improper input validation within the IDIH Visualization (Bouncy Castle Java Library) component in Oracle Communications Diameter Signaling Router (DSR). A remote non-authenticated attacker can exploit this vulnerability to gain access to sensitive information.

Install updates from vendor's website.

Fuse: before 7.1.0

• cpe:2.3:a:red_hat:fuse:*:*:*:*:*:*:*:*

https://access.redhat.com/errata/RHSA-2018:2669

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.