ESB-2018.2712 - [RedHat] Red Hat JBoss Fuse: Multiple vulnerabilities 2018-09-12

Printable version
PGP/GPG verifiable version

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2018.2712
                    Important: Fuse 7.1 security update
                             12 September 2018

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Red Hat JBoss Fuse
Publisher:         Red Hat
Operating System:  Red Hat
Impact/Access:     Execute Arbitrary Code/Commands -- Remote/Unauthenticated      
                   Access Privileged Data          -- Remote/Unauthenticated      
                   Increased Privileges            -- Existing Account            
                   Cross-site Scripting            -- Remote with User Interaction
                   Provide Misleading Information  -- Remote/Unauthenticated      
                   Denial of Service               -- Remote with User Interaction
                   Reduced Security                -- Remote/Unauthenticated      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2018-1000180 CVE-2018-1000130 CVE-2018-1000129
                   CVE-2018-8088 CVE-2018-8036 CVE-2018-1339
                   CVE-2018-1338 CVE-2018-1272 CVE-2018-1271
                   CVE-2018-1114 CVE-2017-14063 CVE-2016-1000352
                   CVE-2016-1000346 CVE-2016-1000345 CVE-2016-1000344
                   CVE-2016-1000343 CVE-2016-1000342 CVE-2016-1000341
                   CVE-2016-1000340 CVE-2016-1000339 CVE-2016-1000338
                   CVE-2016-5397 CVE-2014-0114 

Reference:         ASB-2014.0121
                   ASB-2014.0077
                   ESB-2014.0737
                   ESB-2014.0684

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2018:2669

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Fuse 7.1 security update
Advisory ID:       RHSA-2018:2669-01
Product:           Red Hat JBoss Fuse
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:2669
Issue date:        2018-09-11
Cross references:  RHBA-2018:2665-04
CVE Names:         CVE-2014-0114 CVE-2016-5397 CVE-2016-1000338 
                   CVE-2016-1000339 CVE-2016-1000340 CVE-2016-1000341 
                   CVE-2016-1000342 CVE-2016-1000343 CVE-2016-1000344 
                   CVE-2016-1000345 CVE-2016-1000346 CVE-2016-1000352 
                   CVE-2017-14063 CVE-2018-1114 CVE-2018-1271 
                   CVE-2018-1272 CVE-2018-1338 CVE-2018-1339 
                   CVE-2018-8036 CVE-2018-8088 CVE-2018-1000129 
                   CVE-2018-1000130 CVE-2018-1000180 
=====================================================================

1. Summary:

An update is now available for Red Hat Fuse.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

Red Hat Fuse, based on Apache ServiceMix, provides a small-footprint,
flexible, open source enterprise service bus and integration platform.

This release of Red Hat Fuse 7.1 serves as a replacement for Red Hat Fuse
7.0, and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.

Security Fix(es):

* Apache Struts 1: Class Loader manipulation via request parameters
(CVE-2014-0114)

* thrift: Improper file path sanitization in
t_go_generator.cc:format_go_output() of the go client library can allow an
attacker to inject commands (CVE-2016-5397)

* slf4j: Deserialisation vulnerability in EventData constructor can allow
for arbitrary code execution (CVE-2018-8088)

* jolokia: JMX proxy mode vulnerable to remote code execution
(CVE-2018-1000130)

* bouncycastle: DSA does not fully validate ASN.1 encoding during signature
verification allowing for injection of unsigned data (CVE-2016-1000338)

* bouncycastle: Information leak in AESFastEngine class (CVE-2016-1000339)

* bouncycastle: Information exposure in DSA signature generation via timing
attack (CVE-2016-1000341)

* bouncycastle: ECDSA improper validation of ASN.1 encoding of signature
(CVE-2016-1000342)

* bouncycastle: DHIES implementation allowed the use of ECB mode
(CVE-2016-1000344)

* bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle
attack (CVE-2016-1000345)

* bouncycastle: Other party DH public keys are not fully validated
(CVE-2016-1000346)

* bouncycastle: ECIES implementation allowed the use of ECB mode
(CVE-2016-1000352)

* async-http-client: Invalid URL parsing with '?' (CVE-2017-14063)

* undertow: File descriptor leak caused by
JarURLConnection.getLastModified() allows attacker to cause a denial of
service (CVE-2018-1114)

* spring-framework: Directory traversal vulnerability with static resources
on Windows filesystems (CVE-2018-1271)

* tika: Infinite loop in BPGParser can allow remote attacker to cause a
denial of service (CVE-2018-1338)

* tika: Infinite loop in ChmParser can allow remote attacker to cause a
denial of service (CVE-2018-1339)

* pdfbox: Infinite loop in AFMParser.java allows for out of memory erros
via crafted PDF (CVE-2018-8036)

* jolokia: Cross site scripting in the HTTP servlet (CVE-2018-1000129)

* bouncycastle: flaw in the low-level interface to RSA key pair generator
(CVE-2018-1000180)

* bouncycastle: Carry propagation bug in math.raw.Nat??? class
(CVE-2016-1000340)

* bouncycastle: DSA key pair generator generates a weak private key by
default (CVE-2016-1000343)

* spring-framework: Multipart content pollution (CVE-2018-1272)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Red Hat would like to thank Chris McCown for reporting CVE-2018-8088.

3. Solution:

Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.

Installation instructions are located in the download section of the
customer portal.

The References section of this erratum contains a download link (you must
log in to download the update).

4. Bugs fixed (https://bugzilla.redhat.com/):

1091938 - CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters
1487563 - CVE-2017-14063 async-http-client: Invalid URL parsing with '?'
1544620 - CVE-2016-5397 thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands
1548909 - CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution
1559316 - CVE-2018-1000130 jolokia: JMX proxy mode vulnerable to remote code execution
1559317 - CVE-2018-1000129 jolokia: Cross site scripting in the HTTP servlet
1564408 - CVE-2018-1272 spring-framework: Multipart content pollution
1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
1572421 - CVE-2018-1338 tika: Infinite loop in BPGParser can allow remote attacker to cause a denial of service
1572424 - CVE-2018-1339 tika: Infinite loop in ChmParser can allow remote attacker to cause a denial of service
1573045 - CVE-2018-1114 undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service
1588306 - CVE-2018-1000180 bouncycastle: flaw in the low-level interface to RSA key pair generator
1588313 - CVE-2016-1000338 bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data
1588314 - CVE-2016-1000344 bouncycastle: DHIES implementation allowed the use of ECB mode
1588323 - CVE-2016-1000345 bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack
1588327 - CVE-2016-1000346 bouncycastle: Other party DH public keys are not fully validated
1588330 - CVE-2016-1000352 bouncycastle: ECIES implementation allowed the use of ECB mode
1588688 - CVE-2016-1000340 bouncycastle: Carry propagation bug in math.raw.Nat??? class
1588695 - CVE-2016-1000339 bouncycastle: Information leak in AESFastEngine class
1588708 - CVE-2016-1000341 bouncycastle: Information exposure in DSA signature generation via timing attack
1588715 - CVE-2016-1000342 bouncycastle: ECDSA improper validation of ASN.1 encoding of signature
1588721 - CVE-2016-1000343 bouncycastle: DSA key pair generator generates a weak private key by default
1597490 - CVE-2018-8036 pdfbox: Infinite loop in AFMParser.java allows for out of memory erros via crafted PDF

5. References:

https://access.redhat.com/security/cve/CVE-2014-0114
https://access.redhat.com/security/cve/CVE-2016-5397
https://access.redhat.com/security/cve/CVE-2016-1000338
https://access.redhat.com/security/cve/CVE-2016-1000339
https://access.redhat.com/security/cve/CVE-2016-1000340
https://access.redhat.com/security/cve/CVE-2016-1000341
https://access.redhat.com/security/cve/CVE-2016-1000342
https://access.redhat.com/security/cve/CVE-2016-1000343
https://access.redhat.com/security/cve/CVE-2016-1000344
https://access.redhat.com/security/cve/CVE-2016-1000345
https://access.redhat.com/security/cve/CVE-2016-1000346
https://access.redhat.com/security/cve/CVE-2016-1000352
https://access.redhat.com/security/cve/CVE-2017-14063
https://access.redhat.com/security/cve/CVE-2018-1114
https://access.redhat.com/security/cve/CVE-2018-1271
https://access.redhat.com/security/cve/CVE-2018-1272
https://access.redhat.com/security/cve/CVE-2018-1338
https://access.redhat.com/security/cve/CVE-2018-1339
https://access.redhat.com/security/cve/CVE-2018-8036
https://access.redhat.com/security/cve/CVE-2018-8088
https://access.redhat.com/security/cve/CVE-2018-1000129
https://access.redhat.com/security/cve/CVE-2018-1000130
https://access.redhat.com/security/cve/CVE-2018-1000180
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=distributions&version=7.1.0
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.1/
https://access.redhat.com/articles/2939351

6. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBW5d0pdzjgjWX9erEAQg6Yw//dFPzbxBQz8m4jwPwRjNmTDM/tTOnxZSt
MTqjRp8zX80qhQVMlVj7d9TQLX25bR9Vx4//Kktu3EIsON+ddxy+LZQBlX7l4XMy
SP8FGfSp+GV6jiS+aOoRw+NaE8omM8AwYi0Clv562FIcM8qiqGt+O/QK0peN5JYA
COa/6uSPsNftk7Sq3aQ0jWV35L92r2S1FeIg6FGanyqLO1Y+sKePY5T5HRSNpp06
lh00QeAdYlcGrIBbsQnds4uHW5PPrS7HoafCEuIPdCDoCjZTms3i9K3f57ZQ6ojn
mpKaQgiWVPGenzAIh+JzFaMWTdMwVt6nDPuSt9SC6uDC20c+ffBjjsC2w0Bh/bVr
yxas3NTobxggV8lN0PF0MHx776QtRyc+XukUZ+7FPm6irhfqMVBkUrD95s/qjNNF
KNm8Nsz+HFqwaP0XCkfiBTPZs5yWf83KA/Qw9MOoJGVLXF28wzrELxPl8eMizCtX
MCfop2FzGCCMkanRHMzZ+RkFQ9+wN+WHw1UXiANEaM+55yGfIWhqYOH2zQZzByNY
YdKlSrAw2jvODvawFclMYG+zD97pr1VMvLb8W8uUiqRwKnsu303EtTk+IyTCcoS9
KDczeRZr/X98Ww0gXOEnUcVsTby6fhbtIgUbPt/3obsV6joyaHf5/mHj49uPluva
TLag+xVs1p4=
=vq4F
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBW5ij3WaOgq3Tt24GAQgEOQ//ZlT7PcP9DsLvQSRq56brQmhbEfG2W7LB
zBP5DPiCGpPtcHklx0sMkezF6tTOEVogZD8NnFgsHHcMDnBU4YAW6BDJ9IFkVs7n
Y4f2yYLtKzZtNHVdiaL8HGyZiaGao5sE9XYtY7VttLp2G5bnPkw3lFIAHCoouJmB
C/IXqJBgC8+aqgyhusWnGaU666TtCyr4J29G2De8hbfZx69nTwB0eFsKiMn5zdk+
vP72lBICcKVwhPLTjNr/iFfx7CpH7QfP5Tbc7VrFOxnN3OiV3BoknEyZ//1M/3+4
Qiw6Esantp8EZt4gs7hKzBJSUgH8scRtvoRmBdDHBGKfVoDiWE/eGgRWdieui586
6m+sLGe99nYJc2R/rxVK874MGcpFeFwOtHrhlm0WieZ/QeI0MnwcHU8sV1a9jECY
1guENSHTdXD8x+BBtYWBFIk94g1w5vVxPyk2Ll7/19YgbjGMOwOMNVBZw4SIzjRu
mM6XFIzXTe+0t9uW5uCAzSyp2VmH/tLjJ+2zm9mNzN/hVZjyYQi+QQXvYXPzoPr8
/3k0ZHGlBYVYelzOc5BG58jC9ghqvkw4m/wZK59G9j0BlDiGmtS6hm6mxKf+0sMX
3vBrkNnNYU23DEovkina+7z91O608q+N4dXG+vpve5LMvrj2yyRn6iOxkT/DSKJ1
vLwI6Z1CoR4=
=vMgG
-----END PGP SIGNATURE-----

« Back to bulletins