RHLW-2026-b317db59e3a4f8c7: Lightwell Security Advisory: jolokia-core 1.3.7.rhlw-00001
Red Hat Lightwell has released org.jolokia:jolokia-core 1.3.7.rhlw-00001 with backported fixes for CVE-2018-1000129 and CVE-2018-10899.
CVE-2018-1000129: An XSS vulnerability exists in the Jolokia agent version 1.3.7 in the HTTP servlet that allows an attacker to execute malicious javascript in the victim's browser.
CVE-2018-10899: A flaw was found in Jolokia versions from 1.2 to before 1.6.1. Affected versions are vulnerable to a system-wide CSRF. This holds true for properly configured instances with strict checking for origin and referrer headers. This could result in a Remote Code Execution attack.
This patched artifact is a drop-in replacement for org.jolokia:jolokia-core 1.3.7 from Maven Central.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
red-hat-lightwell/org.jolokia:jolokia-coreto a version that resolves this vulnerability.Fixed in 1.3.7.rhlw-00001 - Upgrade
Upgrade
org.jolokia:jolokia-coreto a version that resolves this vulnerability.Fixed in 1.3.7.rhlw-00001
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which Jolokia deployments are affected by the CSRF flaw?
Jolokia versions from 1.2 up to, but not including, 1.6.1 are affected. The flaw applies even to instances configured with strict Origin and Referer header checking.
What does an attacker need to exploit these issues?
The XSS issue requires a victim’s browser to process malicious JavaScript through the Jolokia HTTP servlet. The CSRF issue is system-wide and may lead to remote code execution; the supplied data does not specify additional authentication prerequisites.
Is a fixed replacement available for users of Jolokia Core 1.3.7?
Yes. Red Hat Lightwell released org.jolokia:jolokia-core 1.3.7.rhlw-00001 with backported fixes for both CVE-2018-1000129 and CVE-2018-10899. It is intended as a drop-in replacement for org.jolokia:jolokia-core 1.3.7 from Maven Central.