Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2020.1766
Red Hat build of Thorntail 2.5.1 security and bug fix update
19 May 2020
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: Red Hat build of Thorntail 2.5.1
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Cross-site Scripting -- Remote/Unauthenticated
Denial of Service -- Remote/Unauthenticated
Access Confidential Data -- Remote/Unauthenticated
Provide Misleading Information -- Existing Account
Unauthorised Access -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2020-11620 CVE-2020-11619 CVE-2020-11113
CVE-2020-11112 CVE-2020-11111 CVE-2020-10969
CVE-2020-10968 CVE-2020-10673 CVE-2020-10672
CVE-2020-9548 CVE-2020-9547 CVE-2020-9546
CVE-2020-8840 CVE-2020-7238 CVE-2020-1729
CVE-2019-20330 CVE-2019-17531 CVE-2019-17267
CVE-2019-16943 CVE-2019-16942 CVE-2019-16335
CVE-2019-14893 CVE-2019-14892 CVE-2019-14888
CVE-2019-14887 CVE-2019-14838 CVE-2019-14832
CVE-2019-14820 CVE-2019-14540 CVE-2019-12419
CVE-2019-12406 CVE-2019-12400 CVE-2019-10219
CVE-2019-10201 CVE-2019-10199 CVE-2019-10086
CVE-2019-9515 CVE-2019-9514 CVE-2019-9512
CVE-2019-9511 CVE-2019-3875 CVE-2019-0210
CVE-2019-0205
Reference: ESB-2020.1659
ESB-2020.1504
Original Bulletin:
https://access.redhat.com/errata/RHSA-2020:2067
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat build of Thorntail 2.5.1 security and bug fix update
Advisory ID: RHSA-2020:2067-01
Product: Red Hat OpenShift Application Runtimes
Advisory URL: https://access.redhat.com/errata/RHSA-2020:2067
Issue date: 2020-05-18
CVE Names: CVE-2019-0205 CVE-2019-0210 CVE-2019-3875
CVE-2019-9511 CVE-2019-9512 CVE-2019-9514
CVE-2019-9515 CVE-2019-10086 CVE-2019-10199
CVE-2019-10201 CVE-2019-10219 CVE-2019-12400
CVE-2019-12406 CVE-2019-12419 CVE-2019-14540
CVE-2019-14820 CVE-2019-14832 CVE-2019-14838
CVE-2019-14887 CVE-2019-14888 CVE-2019-14892
CVE-2019-14893 CVE-2019-16335 CVE-2019-16942
CVE-2019-16943 CVE-2019-17267 CVE-2019-17531
CVE-2019-20330 CVE-2020-1729 CVE-2020-7238
CVE-2020-8840 CVE-2020-9546 CVE-2020-9547
CVE-2020-9548 CVE-2020-10672 CVE-2020-10673
CVE-2020-10968 CVE-2020-10969 CVE-2020-11111
CVE-2020-11112 CVE-2020-11113 CVE-2020-11619
CVE-2020-11620
=====================================================================
1. Summary:
An update is now available for Red Hat build of Thorntail.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each
vulnerability. For more information, see the CVE links in the References
section.
2. Description:
This release of Red Hat build of Thorntail 2.5.1 includes security updates,
bug fixes, and enhancements. For more information, see the release notes
page listed in the References section.
Security Fix(es):
* apache-commons-beanutils: does not suppresses the class property in
PropertyUtilsBean by default (CVE-2019-10086)
* cxf: does not restrict the number of message attachments (CVE-2019-12406)
* cxf: OpenId Connect token service does not properly validate the clientId
(CVE-2019-12419)
* hibernate-validator: safeHTML validator allows XSS (CVE-2019-10219)
* HTTP/2: flood using PING frames results in unbounded memory growth
(CVE-2019-9512)
* HTTP/2: flood using HEADERS frames results in unbounded memory growth
(CVE-2019-9514)
* HTTP/2: flood using SETTINGS frames results in unbounded memory growth
(CVE-2019-9515)
* HTTP/2: large amount of data requests leads to denial of service
(CVE-2019-9511)
* jackson-databind: Multiple serialization gadgets (CVE-2019-17531,
CVE-2019-16943, CVE-2019-16942, CVE-2019-17267, CVE-2019-14540,
CVE-2019-16335, CVE-2019-14893, CVE-2019-14892, CVE-2020-9546,
CVE-2020-9547, CVE-2020-9548, CVE-2020-10969, CVE-2020-10968,
CVE-2020-11111, CVE-2020-11112, CVE-2020-11113, CVE-2020-11619,
CVE-2020-11620, CVE-2019-20330, CVE-2020-8840)
* jackson-databind: mishandles the interaction between serialization
gadgets and typing which could result in remote command
execution (CVE-2020-10672, CVE-2020-10673)
* keycloak: adapter endpoints are exposed via arbitrary URLs
(CVE-2019-14820)
* keycloak: missing signatures validation on CRL used to verify client
certificates (CVE-2019-3875)
* keycloak: SAML broker does not check existence of signature on document
allowing any user impersonation (CVE-2019-10201)
* keycloak: CSRF check missing in My Resources functionality in the Account
Console (CVE-2019-10199)
* keycloak: cross-realm user access auth bypass (CVE-2019-14832)
* netty: HTTP Request Smuggling due to Transfer-Encoding whitespace
mishandling (CVE-2020-7238)
* SmallRye: SecuritySupport class is incorrectly public and contains a
static method to access the current threads context class loader
(CVE-2020-1729)
* thrift: Out-of-bounds read related to TJSONProtocol or
TSimpleJSONProtocol (CVE-2019-0210)
* thrift: Endless loop when feed with specific input data (CVE-2019-0205)
* undertow: possible Denial Of Service (DOS) in Undertow HTTP server
listening on HTTPS (CVE-2019-14888)
* wildfly: The 'enabled-protocols' value in legacy security is not
respected if OpenSSL security provider is in use (CVE-2019-14887)
* wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and
'Deployer' user by default (CVE-2019-14838)
* xml-security: Apache Santuario potentially loads XML parsing code from an
untrusted source (CVE-2019-12400)
For more details about the security issues and their impact, the CVSS
score, acknowledgements, and other related information, see the CVE pages
listed in the References section.
3. Solution:
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
The References section of this erratum contains a download link for the
update. You must be logged in to download the update.
4. Bugs fixed (https://bugzilla.redhat.com/):
1649870 - CVE-2019-14820 keycloak: adapter endpoints are exposed via arbitrary URLs
1690628 - CVE-2019-3875 keycloak: missing signatures validation on CRL used to verify client certificates
1728609 - CVE-2019-10201 keycloak: SAML broker does not check existence of signature on document allowing any user impersonation
1729261 - CVE-2019-10199 keycloak: CSRF check missing in My Resources functionality in the Account Console
1735645 - CVE-2019-9512 HTTP/2: flood using PING frames results in unbounded memory growth
1735744 - CVE-2019-9514 HTTP/2: flood using HEADERS frames results in unbounded memory growth
1735745 - CVE-2019-9515 HTTP/2: flood using SETTINGS frames results in unbounded memory growth
1738673 - CVE-2019-10219 hibernate-validator: safeHTML validator allows XSS
1741860 - CVE-2019-9511 HTTP/2: large amount of data requests leads to denial of service
1749487 - CVE-2019-14832 keycloak: cross-realm user access auth bypass
1751227 - CVE-2019-14838 wildfly-core: Incorrect privileges for 'Monitor', 'Auditor' and 'Deployer' user by default
1755831 - CVE-2019-16335 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariDataSource
1755849 - CVE-2019-14540 jackson-databind: Serialization gadgets in com.zaxxer.hikari.HikariConfig
1758167 - CVE-2019-17267 jackson-databind: Serialization gadgets in classes of the ehcache package
1758171 - CVE-2019-14892 jackson-databind: Serialization gadgets in classes of the commons-configuration package
1758182 - CVE-2019-14893 jackson-databind: Serialization gadgets in classes of the xalan package
1758187 - CVE-2019-16942 jackson-databind: Serialization gadgets in org.apache.commons.dbcp.datasources.*
1758191 - CVE-2019-16943 jackson-databind: Serialization gadgets in com.p6spy.engine.spy.P6DataSource
1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol
1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data
1764658 - CVE-2019-12400 xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source
1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default
1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
1772464 - CVE-2019-14888 undertow: possible Denial Of Service (DOS) in Undertow HTTP server listening on HTTPS
1775293 - CVE-2019-17531 jackson-databind: Serialization gadgets in org.apache.log4j.receivers.db.*
1793154 - CVE-2019-20330 jackson-databind: lacks certain net.sf.ehcache blocking
1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling
1802444 - CVE-2020-1729 SmallRye: SecuritySupport class is incorrectly public and contains a static method to access the current threads context class loader
1815470 - CVE-2020-10673 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution
1815495 - CVE-2020-10672 jackson-databind: mishandles the interaction between serialization gadgets and typing which could result in remote command execution
1816170 - CVE-2019-12406 cxf: does not restrict the number of message attachments
1816175 - CVE-2019-12419 cxf: OpenId Connect token service does not properly validate the clientId
1816330 - CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking
1816332 - CVE-2020-9546 jackson-databind: Serialization gadgets in shaded-hikari-config
1816337 - CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap
1816340 - CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core
1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider
1819212 - CVE-2020-10969 jackson-databind: Serialization gadgets in javax.swing.JEditorPane
1821304 - CVE-2020-11111 jackson-databind: Serialization gadgets in org.apache.activemq.jms.pool.XaPooledConnectionFactory
1821311 - CVE-2020-11112 jackson-databind: Serialization gadgets in org.apache.commons.proxy.provider.remoting.RmiProvider
1821315 - CVE-2020-11113 jackson-databind: Serialization gadgets in org.apache.openjpa.ee.WASRegistryManagedRuntime
1826798 - CVE-2020-11620 jackson-databind: Serialization gadgets in commons-jelly:commons-jelly
1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop
5. References:
https://access.redhat.com/security/cve/CVE-2019-0205
https://access.redhat.com/security/cve/CVE-2019-0210
https://access.redhat.com/security/cve/CVE-2019-3875
https://access.redhat.com/security/cve/CVE-2019-9511
https://access.redhat.com/security/cve/CVE-2019-9512
https://access.redhat.com/security/cve/CVE-2019-9514
https://access.redhat.com/security/cve/CVE-2019-9515
https://access.redhat.com/security/cve/CVE-2019-10086
https://access.redhat.com/security/cve/CVE-2019-10199
https://access.redhat.com/security/cve/CVE-2019-10201
https://access.redhat.com/security/cve/CVE-2019-10219
https://access.redhat.com/security/cve/CVE-2019-12400
https://access.redhat.com/security/cve/CVE-2019-12406
https://access.redhat.com/security/cve/CVE-2019-12419
https://access.redhat.com/security/cve/CVE-2019-14540
https://access.redhat.com/security/cve/CVE-2019-14820
https://access.redhat.com/security/cve/CVE-2019-14832
https://access.redhat.com/security/cve/CVE-2019-14838
https://access.redhat.com/security/cve/CVE-2019-14887
https://access.redhat.com/security/cve/CVE-2019-14888
https://access.redhat.com/security/cve/CVE-2019-14892
https://access.redhat.com/security/cve/CVE-2019-14893
https://access.redhat.com/security/cve/CVE-2019-16335
https://access.redhat.com/security/cve/CVE-2019-16942
https://access.redhat.com/security/cve/CVE-2019-16943
https://access.redhat.com/security/cve/CVE-2019-17267
https://access.redhat.com/security/cve/CVE-2019-17531
https://access.redhat.com/security/cve/CVE-2019-20330
https://access.redhat.com/security/cve/CVE-2020-1729
https://access.redhat.com/security/cve/CVE-2020-7238
https://access.redhat.com/security/cve/CVE-2020-8840
https://access.redhat.com/security/cve/CVE-2020-9546
https://access.redhat.com/security/cve/CVE-2020-9547
https://access.redhat.com/security/cve/CVE-2020-9548
https://access.redhat.com/security/cve/CVE-2020-10672
https://access.redhat.com/security/cve/CVE-2020-10673
https://access.redhat.com/security/cve/CVE-2020-10968
https://access.redhat.com/security/cve/CVE-2020-10969
https://access.redhat.com/security/cve/CVE-2020-11111
https://access.redhat.com/security/cve/CVE-2020-11112
https://access.redhat.com/security/cve/CVE-2020-11113
https://access.redhat.com/security/cve/CVE-2020-11619
https://access.redhat.com/security/cve/CVE-2020-11620
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=catRhoar.thorntail&version=2.5.1
https://access.redhat.com/documentation/en-us/red_hat_build_of_thorntail/2.5/html/release_notes_for_thorntail_2.5/
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIVAwUBXsJiutzjgjWX9erEAQiHow/+K6tzrL47AH0MyHlunM22XouhjDzHimuv
PMtxx7D7fekEcYh8MV15X8ahMhbPF19AUfVmZeeXOu8NEq55RNc5BnI0fV/7bMIl
c6E+dsCPj8U2IDTGJRrXthxrHvaDlqG3owBDf3ynseiBXHBtmxK2bY5hWdWo5bo8
LKXOsrfqCrnFW6sznOAqJtZUZ/8Li3MeN+Ax9RZYajLU6SI+EpKu0ufSL3OW8p9l
pt2+dQYey4fjG5pJhBqKZpNJGxnrQR66CegCjf475xO1EJ9pYtBdUxdh1Hi2Elog
fa1H6PR7mCJgXWXZJK1aJ9G4EmcupivwhAR9EzEW/L095NAnSvf5qUuvJc4c1AO+
UVy+EZaTvCr+bljQWTdqRFJmgHsUeDY5gn7nMma362h6p0hZ96zTaWilLwxrWkR8
S90OHxT17bE2NdWXprsoQ8T0F32DdakZn4o1auNLiuGmRJdiIr3hNBOgMaUe7IUo
5KwImgPqnVQ46Uy8OH7vsUInJksR7VRl7bmVZEZj/qfstMRgmFAiMMa84TopoOkO
0qJHleIRbioRy/cAbF7KTfrs3AfABrjjSVnrpJUzTLZ0pe7IKN+kySL669wwcJo+
Dwx1XXdRFshRYztuJwe6N/yK5w6k9Li09V+PyT8/FjEQlVZU/BJpWusRgdxL5ZvK
mvoXWO57ZDY=
=g6NJ
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXsMqnuNLKJtyKPYoAQjnsQ/9ESzWD5pd0oEwoFwmGEGiUu7ZQKdCAFRl
kYMn2aoAf7pef0vYl5VEHxixNJbsLA0OjpY62czRLqBM6z/giTg8czPgnJMRRl6o
pOUSPXkI9HEnz3Jo4k4Fq6tlecR//GhACDD6r/skaogNHwmo0ynHq2PetF7gK8nM
LuA/CiV6niQlPBt83o08gSnDGrUSkLdok+7na2k4mrzE/gWGeks8pBqVbdyZtwFp
syYO1h9viQ9VCFvUTYtObiuDU/sXTK8O+yCckSitVCGWK/Ozn1B6+VVr+uW67fIf
/inehZnPZoDH74zdKlIf+tyc5g5tHPrDNKH/fgG6l3C1MSUL7vJpSGdJiK9GvdEm
afJx6aTkhknkM+87kB9wNkRbklaiubKPGbbn6aigIGzUG62fxMYBVRqzmG+0DqTl
Oo0a5hKX9OXjyXfEPZkaOxoeljDWtu9zJrlRHa4xRsdVQaufqOdJWPqP9Zte4Jla
iX9xKTgv+0ER8yj52E2pNpZoWsOEb2sqwfXqaawbk1eIfTkQbycB60CNubsRZczg
uIAJ1RJ8yr5cMWg/P8iI82nL86GW+N4IgqExDaEmjFb+pvPVHvq62+lPViQhXOh5
tpz3I7vNEOdQCa43J7EPyapMl7cJC5UyfXFG4yiBjQYZ6+Jicr6rpr+nN4Q9a8Vd
MHDm+oojAq8=
=Yk86
-----END PGP SIGNATURE-----