What is the severity of RHSA-2018:1448?

The severity of RHSA-2018:1448 is classified as important.

How do I fix RHSA-2018:1448?

To fix RHSA-2018:1448, you should update to the specified fixed versions of the affected packages.

Which packages are affected by RHSA-2018:1448?

RHSA-2018:1448 affects multiple packages within the Red Hat JBoss Enterprise Application Platform.

Is RHSA-2018:1448 applicable to older versions of Red Hat JBoss?

RHSA-2018:1448 is specifically applicable to Red Hat JBoss Enterprise Application Platform 6.4.20 and earlier versions.

How can I verify if my system is vulnerable to RHSA-2018:1448?

You can verify your system's vulnerability by checking the installed package versions against the affected versions outlined in the advisory.

Vulnerability/
RHSA-2018:1448

14/5/2018

28/6/2024

RHSA-2018:1448: Important: Red Hat JBoss Enterprise Application Platform 6.4.20 security update

First published: Mon May 14 2018(Updated: )

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.<br>This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.<br>Security Fix(es):<br><li> jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095)</li> <li> jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) (CVE-2017-17485)</li> <li> slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)</li> <li> Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability (CVE-2016-4978)</li> <li> solr: Directory traversal via Index Replication HTTP API (CVE-2017-3163)</li> <li> tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)</li> <li> jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.<br>Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; 0c0c0f from 360观星实验室 for reporting CVE-2017-17485; and Chris McCown for reporting CVE-2018-8088.

Never miss a vulnerability like this again

Reference Links

https://access.redhat.com/errata/RHSA-2018:1448 (Advisory)

Frequently Asked Questions

What is the severity of RHSA-2018:1448?
The severity of RHSA-2018:1448 is classified as important.
How do I fix RHSA-2018:1448?
To fix RHSA-2018:1448, you should update to the specified fixed versions of the affected packages.
Which packages are affected by RHSA-2018:1448?
RHSA-2018:1448 affects multiple packages within the Red Hat JBoss Enterprise Application Platform.
Is RHSA-2018:1448 applicable to older versions of Red Hat JBoss?
RHSA-2018:1448 is specifically applicable to Red Hat JBoss Enterprise Application Platform 6.4.20 and earlier versions.
How can I verify if my system is vulnerable to RHSA-2018:1448?
You can verify your system's vulnerability by checking the installed package versions against the affected versions outlined in the advisory.

agent/severity
agent/type
agent/softwarecombine
agent/last-modified-date
agent/first-publish-date
agent/remedy
agent/title
agent/description
collector/redhat-errata
source/Red Hat
anchor-id/RHSA-2018:1448
agent/software-canonical-lookup
agent/references
agent/tags
agent/event
agent/source
package-manager/redhat