RHSA-2017:1217: Moderate: Red Hat JBoss BRMS security update
First published: Tue May 09 2017(Updated: )
Red Hat JBoss BRMS is a business rules management system for the management, storage, creation, modification, and deployment of JBoss Rules.<br>This release of Red Hat JBoss BRMS 6.4.3 serves as a replacement for Red Hat JBoss BRMS 6.4.2, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.<br>Security Fix(es):<br><li> JBoss BRMS 6 and BPM Suite 6 are vulnerable to a stored XSS via several lists in Business Central. The flaw is due to lack of sanitation of user input when creating new lists. Remote, authenticated attackers that have privileges to create lists can store scripts in them, which are not properly sanitized before showing to other users, including admins. (CVE-2017-2674)</li> <li> JBoss BRMS 6 and BPM Suite 6 are vulnerable to a reflected XSS via artifact upload. A malformed XML file, if uploaded, causes an error message to appear that includes part of the bad XML code verbatim without filtering out scripts. Successful exploitation would allow execution of script code within the context of the affected user. (CVE-2017-7463)</li> Red Hat would like to thank Chris Hebert, Vikas Pandey, Harold Schliesske, and Ryan Stanley (Noblis) for reporting these issues.
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Red Hat JBoss Enterprise BRMS Platform | <6.4.3 | |
| Red Hat JBoss BPM Suite | <6 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1439819
- https://bugzilla.redhat.com/show_bug.cgi?id=1439823
- https://access.redhat.com/security/updates/classification/#moderate
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=brms&downloadType=securityPatches&version=6.4
- https://access.redhat.com/errata/RHSA-2017:1217 (Advisory)
Frequently Asked Questions
What is the severity of RHSA-2017:1217?
The severity of RHSA-2017:1217 is classified as moderate.
How do I fix RHSA-2017:1217?
To fix RHSA-2017:1217, you should update your Red Hat JBoss BRMS to version 6.4.3 or later.
What products are affected by RHSA-2017:1217?
RHSA-2017:1217 affects Red Hat JBoss BRMS up to version 6.4.3 and Red Hat BPM Suite 6.
When was RHSA-2017:1217 released?
RHSA-2017:1217 was released as an advisory on a specific date in the year 2017.
What improvements are included in RHSA-2017:1217?
RHSA-2017:1217 includes bug fixes and enhancements for Red Hat JBoss BRMS.
- agent/severity
- agent/event
- agent/type
- agent/last-modified-date
- agent/first-publish-date
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2017:1217
- agent/references
- agent/remedy
- agent/weakness
- agent/title
- agent/description
- agent/source
- agent/softwarecombine
- agent/tags
- agent/guess-ai
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/red hat
- canonical/red hat jboss enterprise brms platform
- canonical/red hat jboss bpm suite