What is the severity of RHSA-2018:1450?

The severity of RHSA-2018:1450 is classified as important.

How do I fix RHSA-2018:1450?

To fix RHSA-2018:1450, you should upgrade to the latest versions of affected packages as specified in the advisory.

Which packages are affected by RHSA-2018:1450?

Affected packages include various components of the Red Hat JBoss Enterprise Application Platform and related projects.

Are there any workaround measures for RHSA-2018:1450?

No specific workarounds are recommended; updating the affected packages is the best preventive measure.

Is RHSA-2018:1450 applicable to all operating systems?

RHSA-2018:1450 is specifically applicable to Red Hat Enterprise Linux running affected JBoss versions.

Vulnerability/
RHSA-2018:1450

14/5/2018

15/5/2024

RHSA-2018:1450: Important: Red Hat JBoss Enterprise Application Platform 6.4.20 security update

First published: Mon May 14 2018(Updated: )

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server. This release of Red Hat JBoss Enterprise Application Platform 6.4.20 serves as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.19, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References. Security Fix(es): <li> jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-7525) (CVE-2017-15095)</li> <li> jackson-databind: Unsafe deserialization due to incomplete black list (incomplete fix for CVE-2017-15095) (CVE-2017-17485)</li> <li> slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)</li> <li> Apache ActiveMQ Artemis: Deserialization of untrusted input vulnerability (CVE-2016-4978)</li> <li> solr: Directory traversal via Index Replication HTTP API (CVE-2017-3163)</li> <li> tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources (CVE-2018-1304)</li> <li> jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries (CVE-2018-7489)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting CVE-2017-15095; 0c0c0f from 360观星实验室 for reporting CVE-2017-17485; and Chris McCown for reporting CVE-2018-8088.

Never miss a vulnerability like this again

Reference Links

https://access.redhat.com/errata/RHSA-2018:1450 (Advisory)

Frequently Asked Questions

What is the severity of RHSA-2018:1450?
The severity of RHSA-2018:1450 is classified as important.
How do I fix RHSA-2018:1450?
To fix RHSA-2018:1450, you should upgrade to the latest versions of affected packages as specified in the advisory.
Which packages are affected by RHSA-2018:1450?
Affected packages include various components of the Red Hat JBoss Enterprise Application Platform and related projects.
Are there any workaround measures for RHSA-2018:1450?
No specific workarounds are recommended; updating the affected packages is the best preventive measure.
Is RHSA-2018:1450 applicable to all operating systems?
RHSA-2018:1450 is specifically applicable to Red Hat Enterprise Linux running affected JBoss versions.

agent/severity
agent/type
agent/last-modified-date
agent/softwarecombine
agent/first-publish-date
agent/title
agent/remedy
agent/description
collector/redhat-errata
source/Red Hat
anchor-id/RHSA-2018:1450
agent/software-canonical-lookup
agent/references
agent/tags
agent/event
agent/source
package-manager/redhat