-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================                   
Red Hat Security Advisory

Synopsis:          Important: EAP Continuous Delivery Technical Preview Release 16 security update
Advisory ID:       RHSA-2020:2564-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:2564
Issue date:        2020-06-15
CVE Names:         CVE-2018-14718 CVE-2018-14719 CVE-2018-14720
                   CVE-2018-14721 CVE-2018-19360 CVE-2018-19361
                   CVE-2018-19362
====================================================================
1. Summary:

This is a security update for JBoss EAP Continuous Delivery 16.0.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat JBoss Enterprise Application Platform CD16 is a platform for Java
applications based on the WildFly application runtime.

This release of Red Hat JBoss Enterprise Application Platform CD16 includes
bug fixes and enhancements.

Security Fix(es):

* jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class
(CVE-2018-14721)
* jackson-databind: arbitrary code execution in blaze-ds-opt and
blaze-ds-core classes (CVE-2018-14719)
* jackson-databind: exfiltration/XXE in some JDK classes (CVE-2018-14720)
* jackson-databind: improper polymorphic deserialization in
jboss-common-core class (CVE-2018-19362)
* jackson-databind: improper polymorphic deserialization in
axis2-transport-jms class (CVE-2018-19360)
* jackson-databind: improper polymorphic deserialization in openjpa class
(CVE-2018-19361)
* jackson-databind: arbitrary code execution in slf4j-ext class
(CVE-2018-14718)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

3. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

You must restart the JBoss server process for the update to take effect.

The References section of this erratum contains a download link (you must
log in to download the update)

4. Bugs fixed (https://bugzilla.redhat.com/):

1666415 - CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class
1666418 - CVE-2018-14719 jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes
1666423 - CVE-2018-14720 jackson-databind: exfiltration/XXE in some JDK classes
1666428 - CVE-2018-14721 jackson-databind: server-side request forgery (SSRF) in axis2-jaxws class
1666482 - CVE-2018-19360 jackson-databind: improper polymorphic deserialization in axis2-transport-jms class
1666484 - CVE-2018-19361 jackson-databind: improper polymorphic deserialization in openjpa class
1666489 - CVE-2018-19362 jackson-databind: improper polymorphic deserialization in jboss-common-core class

5. References:

https://access.redhat.com/security/cve/CVE-2018-14718
https://access.redhat.com/security/cve/CVE-2018-14719
https://access.redhat.com/security/cve/CVE-2018-14720
https://access.redhat.com/security/cve/CVE-2018-14721
https://access.redhat.com/security/cve/CVE-2018-19360
https://access.redhat.com/security/cve/CVE-2018-19361
https://access.redhat.com/security/cve/CVE-2018-19362
https://access.redhat.com/security/updates/classification/#important

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXueqxdzjgjWX9erEAQgwCA//ZwbtBt/RaVyCEfmNxSoEaXff9lQ1udLD
iMuq9a4MloE+4mfqibyAJLFCr4puqeIcfIR1jwbLUsSPCV2enlo08xAkmtU8d6/0
DADRcFxt93eAZBd8hbm1GP4fAI0y8c/PvevuO5n6mkf0fw0LO3wY5EnpvF673oHz
yUjgjgi/v6jTk8LqhOW5gNDDbOyRj7brLHE3t3WFFBE1Osu5fD2g3+yjNk+ONMFK
sEvErBebBHhOH1OSwCVSWDVa+OYAeKWua5mH9UiILD2sWqyMY0x+4JcDQMsR4S2m
QgEunCBlZrD4RxAJcW4PWeEmTBbt8VAyXG6PlnmMEVYlDIpHAAcDepU2dOBompWZ
H8jGzMxHmmrjeMyVls6poAuIK0Rro8W/fSEHbHH4SRuO0E59FLGx5WD2lhgnQ9l8
Q0IUXiGdB+MtD8njwGEqRlnZ8Ipfmsgauoe32n0fvQfQPUXAf9GP4+OcYkl72kXr
2ilC1YmbGwUyA3vXekHAQ4spWUd83B++sFknoG/0KmgRNnCMwXjkYT3tjiJaz56U
afl9fBmXV/CKvL0A1KgzML8h8/aGu/IF1tpuDx+xwR9bJdn0fvN/Yi7FaPqcvn53
bwZ64TxYseGNPDpcUbr6qFiEzeNS9h9Vn3JwmbMYY20qytMr1K5ZZcWw2YbdwOG0
Lo4jPNpH0Hw=WCi+
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce