Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.1493
Important: Red Hat Fuse 7.3 security update
1 May 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat Fuse 7.3
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-7657 CVE-2017-7525 CVE-2014-0112
Reference: ASB-2018.0159
ASB-2018.0083
Original Bulletin:
https://access.redhat.com/errata/RHSA-2019:0910
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat Fuse 7.3 security update
Advisory ID: RHSA-2019:0910-01
Product: Red Hat JBoss Fuse
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0910
Issue date: 2019-04-30
CVE Names: CVE-2014-0112 CVE-2017-7525 CVE-2017-7657
=====================================================================
1. Summary:
A minor version update (from 7.2 to 7.3) is now available for Red Hat Fuse.
The purpose of this text-only errata is to inform you about the security
issues fixed in this release.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
This release of Red Hat Fuse 7.3 serves as a replacement for Red Hat Fuse
7.2, and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* jackson-databind: A deserialization flaw was discovered in the
jackson-databind which could allow an unauthenticated user to perform code
execution by sending the maliciously crafted input to the readValue method
of the ObjectMapper. (CVE-2017-7525)
* struts2: ClassLoader manipulation via request parameters (CVE-2014-0112)
* jetty: HTTP request smuggling (CVE-2017-7657)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
3. Solution:
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
Installation instructions are available from the Fuse 7.3.0 product
documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/
4. Bugs fixed (https://bugzilla.redhat.com/):
1091939 - CVE-2014-0112 struts2: ClassLoader manipulation via request parameters
1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
1595620 - CVE-2017-7657 jetty: HTTP request smuggling
5. References:
https://access.redhat.com/security/cve/CVE-2014-0112
https://access.redhat.com/security/cve/CVE-2017-7525
https://access.redhat.com/security/cve/CVE-2017-7657
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.3.0
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/html-single/release_notes/
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXMhsVtzjgjWX9erEAQiuIQ//WMwCvvPMgxvwwGQbhOTpgO41r7fSLPGP
amoRE0KzCUX0YCZbth5GsmX/yMrCJVyptMpOoZIiJa3v9dZRsN74EW++UCF0B3L3
+RGtrOp+oOI+SaqLIWg+mgiIGKWDpCbc3n58Rmxd+wbgp4L31I4ugT/wZdnXakuM
8MC5wPZ12KFnq2uIooUvkisV16+9hxSkX/E8SXlBm8hMC17yTIOfWL5mBcGmK+1B
z1i7MCW3Ql18ZGZm1n74ZOBlS5LEuInUz6zIeC7IXBA28U2lYw7i7/inPTXrdjkz
Q0SAQ5k6Jp0wWy1s5zNvQm1d03+NPOMFFcjxTcNJbkDM5Lo6eIMViD5GBRMtrLap
ExdwosS7V7J0dNdJ5Owo4aeI8m+AjnlRMvomiHCtTHAENOGCc1wbZQjjq2Tp5zG0
m23s+v6tOX56fBGWuqF6SpauF4FODRtoiTGpUkuVmC9/F9fVHlWUdne93B2PiG3G
kvbIR55Z0htil4rqcvhBfVksb4sj/sxQy9drwhMO2PUVom3N6givCq8K47toxJx3
TBPtDDJ5bEqknaUNbhbzfsKrc69qo8Zv6zzKRzmiIeny9QL8rJcj95NQMPM/+y3n
CVjct2us1/Y6XIEK76hgBlrBS5DJbk/w5i/q+LsKfkSsbB7AbvCmJQ2wi54mXVkg
bKht2vPZTfc=
=o3Ix
- -----END PGP SIGNATURE-----
- --
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXMks22aOgq3Tt24GAQhqCg/9EEfFIfwoEoDY+VEGJ/araBn8zyMGyxcl
uHM1yzQn75Zu+NoA3QNeYmoGidUlTqRC6/UPFe3aU0SMk23x1DSWYNV170tab0wM
EhxGmjFvOpikwD5fOwQvzCw7dI5w15alOOzn6wrRTRo2+XtThvTI4YBk2Vh93Iyg
lncZcp9Z8c9zodOgpZ1lv60qCvhid2r7ubMyN9uLlSUzhCe4EkvKHLlS9040zhu3
1KlCSd56jz4KT9L2dRx9VY8J9FYWMYW8EU6FWbDXjBwEzUon4miC+BEZ0uyqrRHu
Dk1LGc1C4z1OtBHRrsAGlVtxBgB8glpAC48q9jdjiXc1vZYVuY+4uIzO9aqZMUVj
mReHVrAtJdin08nUASXCFV7DN64mdKZ49+tjz2ASqG0rDDCHsnelZTP50CS1Hp2R
dFtbkTkmxzoW1Owv594wVB9kJbiSx8KpeJgDz+WvRPhxqw9iFSPxMbOZM58IO5rt
FBuj2SXdbcRGNgxW7Qea7gO7l5z7xCF9kfMLFVGvuDvDbss6JEGFK6RfgozeKise
Z2g4mHYjE9Wb0poFFfZkXOXR3IGYsj/dTwmQSR209/iYCs83TDXMaGgnBWIgUXYK
kMMxbpZx9ZrAbJzv2hAqoMRfHmQUk3J1E5IMD0rfTBML7VcI/thvXKROMdRdPzIw
mWXUtukKu1w=
=Vvod
-----END PGP SIGNATURE-----