Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2019.3806 Red Hat FIS 2.0 on Fuse 6.3.0 R13 security and bug fix update 11 October 2019 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Red Hat JBoss Fuse Publisher: Red Hat Operating System: Red Hat Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated Denial of Service -- Remote/Unauthenticated Access Confidential Data -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2018-19362 CVE-2018-19361 CVE-2018-19360 CVE-2018-14719 CVE-2018-14718 CVE-2018-12023 CVE-2018-12022 CVE-2018-11307 Reference: ESB-2019.3643 ESB-2019.2734 Original Bulletin: https://access.redhat.com/errata/RHSA-2019:3002 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat FIS 2.0 on Fuse 6.3.0 R13 security and bug fix update Advisory ID: RHSA-2019:3002-01 Product: Red Hat JBoss Fuse Advisory URL: https://access.redhat.com/errata/RHSA-2019:3002 Issue date: 2019-10-10 CVE Names: CVE-2018-11307 CVE-2018-12022 CVE-2018-12023 CVE-2018-14718 CVE-2018-14719 CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 ===================================================================== 1. Summary: An update is now available for Red Hat Fuse Integration Services. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat Fuse Integration Services provides a set of tools and containerized xPaaS images that enable development, deployment, and management of integration microservices within OpenShift. Security fix(es): * jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis (CVE-2018-11307) * jackson-databind: improper polymorphic deserialization of types from Jodd-db library (CVE-2018-12022) * jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver (CVE-2018-12023) * jackson-databind: arbitrary code execution in slf4j-ext class (CVE-2018-14718) * jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes (CVE-2018-14719) * jackson-databind: improper polymorphic deserialization in axis2-transport-jms class (CVE-2018-19360) * jackson-databind: improper polymorphic deserialization in openjpa class (CVE-2018-19361) * jackson-databind: improper polymorphic deserialization in jboss-common-core class (CVE-2018-19362) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Updating instructions and release notes may be found at: https://access.redhat.com/articles/3060411 4. Bugs fixed (https://bugzilla.redhat.com/): 1666415 - CVE-2018-14718 jackson-databind: arbitrary code execution in slf4j-ext class 1666418 - CVE-2018-14719 jackson-databind: arbitrary code execution in blaze-ds-opt and blaze-ds-core classes 1666482 - CVE-2018-19360 jackson-databind: improper polymorphic deserialization in axis2-transport-jms class 1666484 - CVE-2018-19361 jackson-databind: improper polymorphic deserialization in openjpa class 1666489 - CVE-2018-19362 jackson-databind: improper polymorphic deserialization in jboss-common-core class 1671096 - CVE-2018-12023 jackson-databind: improper polymorphic deserialization of types from Oracle JDBC driver 1671097 - CVE-2018-12022 jackson-databind: improper polymorphic deserialization of types from Jodd-db library 1677341 - CVE-2018-11307 jackson-databind: Potential information exfiltration with default typing, serialization gadget from MyBatis 5. References: https://access.redhat.com/security/cve/CVE-2018-11307 https://access.redhat.com/security/cve/CVE-2018-12022 https://access.redhat.com/security/cve/CVE-2018-12023 https://access.redhat.com/security/cve/CVE-2018-14718 https://access.redhat.com/security/cve/CVE-2018-14719 https://access.redhat.com/security/cve/CVE-2018-19360 https://access.redhat.com/security/cve/CVE-2018-19361 https://access.redhat.com/security/cve/CVE-2018-19362 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/articles/3060411 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2019 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXZ8o/9zjgjWX9erEAQjkpQ//VlEryEs6//fH3XL75mkGiOhEIPuyz7+0 ICG74MGZZNFYEqx9z8smQIIlfJHd2nHky9g4A9WY0K1DZglZDBDKooQVulHbqko4 6uSYx2IhpEqM16/EWPaqt3qqnDEcMYP3erq0QmAKAN5uiofGpiWH91lnkq/O/os7 l9hMGjlLqAiu0FxvnZTj1GrdldGNeS7XihpN1VoAwp6DnXxYloualETwKum7l4cY MKIjEqts+VtKq4l+xKN235wC/1yC8Qr9xnwn/4r5a5NpscN9g6vl7cTQdAjia2rP P8JDbYFByr96RDjyy5gVScDDyoI8OrCuNH2tBD4gbUh31czHvWxrOZ/icTKYSGqS AAYrvl0GTeHrIsuedar/PFiDj8+KawvuREbqHV1hkjIDTPqch7HCVfT0K92Y67n6 sMPkQY8Z/eKQEFhcrK+yMDZdWOxLraSUKfYXrgRqtDlAUvDFcWqLlSkTw8VsLxMr q/1uComAPUfSK4mBTq6Rb5mzSqHDT3G8rvV/btlE9jzaN+E9fJcSso+O+cjA3n9a gT8EsRcGcHphv0eL0Sw7Cm/wyrYXd6nRxGYtzfcG/3DAooSRPs6ONGCee485OAP8 Vm6FySuRJD50IDxsRembvCpZYih7ixZMBFIJRG9m2+7M7JF1hJ6pYEeFQyKPdQO3 oe1GMGqOWFA= =SLu4 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBXZ/N8WaOgq3Tt24GAQi8IQ/9Fb3Tuv2D6RtUhyqKBLMHAWC04ji0ZSX6 SvKbgkMNyADMrplpMD3bohwR3Oto9VpXoG+GFxQuna5UhRgMVoKErI/z9jPmjHJJ ezH8DDCwH5KbpCxIBFWTiY0cVafQSe+ukjQM0ia/W4U85Lg/zDdc7rF1s6Usu0g9 OpSKDBiFbK+O1vXa7Gc/SkZgz50WYFdsAhlDDBhSaghQejvLWpVRP5yYLTE1sB0h oj9aUcYcxBpJxsUL+rqblm27t4o0GDjWqWoeThDJxPrrKUxbi/ATxK5vfbdqvGSC 6Yqq/gKcOwyp4OUwY4vky/g+JuHj01ok4Wr0x0MD+kMeryj7mQzBj+/0tYBJ1o1a hEfgf3xZIN+0HgdDnid/fXYdcrNd+gBNtsj8xhIeK2gc1L6yWv+dSoVjBuEaIogG +dvZ7TNgwOjCyqXjIl1IVm53fnh6lnPcW2JzN7uRLFte2YtJVCiytrVKtALqaUfW oyyWv7MEprJGW1P8EcMjzU3riG03/ALl92LDERxXJWB+HFLH9JVLuObm33LFrMeJ Qp/zVs2s1HHWvheT5rdRJszT4oTraigQx38ufX4PlKr6t/VGSvuBW5qZ+6QRuBSL 8HF4dQy+bSJ2rTjJGFJgKSbL7CHEWoxLrlZm0lzc6EP6U0vox847vjygKDnbNB7J gULp2SQufNM= =TcjY -----END PGP SIGNATURE-----