Synopsis

Moderate: Red Hat JBoss Enterprise Application Platform security update

Type/Severity

Security Advisory: Moderate

Topic

A security update is now available for Red Hat JBoss Enterprise Application
Platform 7 for Red Hat Enterprise Linux 6 and 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

[Updated 6th November 2017]
Previously, this erratum was marked as having a security impact of Critical. This was incorrect; Red Hat JBoss Enterprise Application Platform 7 was affected with a security impact of Moderate. This advisory has been updated to that effect.

Description

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This asynchronous patch is a security update for lucene package in Red Hat JBoss Enterprise Application Platform 7.0.8.

Security Fix(es):

• It was found that Apache Lucene would accept an object from an unauthenticated user that could be manipulated through subsequent post requests. An attacker could use this flaw to assemble an object that could permit execution of arbitrary code if the server enabled Apache Solr's Config API. (CVE-2017-12629)
  

For more information regarding CVE-2017-12629, see the article linked in the references section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• JBoss Enterprise Application Platform 7.1 for RHEL 7 x86_64
• JBoss Enterprise Application Platform 7.1 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 7.1 for RHEL 6 i386
• JBoss Enterprise Application Platform 7.0 for RHEL 7 x86_64
• JBoss Enterprise Application Platform 7.0 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 7.0 for RHEL 6 i386

Fixes

• BZ - 1501529 - CVE-2017-12629 Solr: Code execution via entity expansion

CVEs

• CVE-2017-12629

References

• https://access.redhat.com/security/updates/classification/#moderate
• https://access.redhat.com/security/vulnerabilities/CVE-2017-12629
• https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/

JBoss Enterprise Application Platform 7.1 for RHEL 7

SRPM
eap7-lucene-solr-5.3.1-4.redhat_2.1.ep7.el7.src.rpm	SHA-256: ef942f191ae266d33dc67e4bda83de511633eaa3423d3bd5ba2b24f833f5f1ed
x86_64
eap7-lucene-analyzers-common-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 54109b508278b969236d24543bd779923af81b3a5f62ea1fdc4cc25a0ff9dc30
eap7-lucene-backward-codecs-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 45f126d139a80b5805e3e65a20acec52e7f3b62107cbbea7672ad0d2460bc44e
eap7-lucene-core-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 1fcfe40077c326253efc07c4aec840030dc97dfd7fbf7aea1ec7e03ea4dd1eca
eap7-lucene-facet-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: b8df0b0869a6daea3d598778102cc2c12b046a06048d5697c582e10ce9338c5f
eap7-lucene-misc-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 743a65ca5650337bf22890a09b74e47a2101ae46d5c6cd1b6259e841e77db330
eap7-lucene-queries-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 863855fbe16f5e319557d36533e4e9a6ebd0857aac4e7f17548e722154e819a1
eap7-lucene-queryparser-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 8b3503ae63e2847edc3ee356a7589e27ee62cb926c35719e272f2309b3db447d
eap7-lucene-solr-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 1ff166251a7911ee2526f304e34e54edfe86604efe3b8f657cbf20591160a883

JBoss Enterprise Application Platform 7.1 for RHEL 6

SRPM
eap7-lucene-solr-5.3.1-4.redhat_2.1.ep7.el6.src.rpm	SHA-256: 28da5e0eb86ce8870211d5cf5b04be44c21837692acb5d448cd7ad3cccfe2c0c
x86_64
eap7-lucene-analyzers-common-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 3d5496449ef7ba005ede8c56a20505a1ce972287c7774e142c9e94ff2f078bce
eap7-lucene-backward-codecs-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 2381b9c4be5ddc202fe740e6782988cade752541a8509f7c06fa3e722e4531df
eap7-lucene-core-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: b7af09e7d50ec9ac1fd4e92f7a3d867c57d3159c64d12e59f388838820312cec
eap7-lucene-facet-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: a222b28410037a1b44af52e05bce9f4d71763c556c6d12fdadea73fb499e4c61
eap7-lucene-misc-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 9d83c32d466191f7f67a9c8d7c4f36dd9af795ec6efeb13f831653f993f89ed6
eap7-lucene-queries-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 5696600f0656473448066194455b9cb57a19b4915ca5862873f53c9633d8a462
eap7-lucene-queryparser-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 1f35552cfbe8b2776e0d56e0a4f8f43b1d66524e8d028a81ddefe7e992eb2469
eap7-lucene-solr-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: d7d20a75bf1ae893f66f7541de10e7fdc5cc346712a5060eaa3a064bd888b3e6
i386
eap7-lucene-analyzers-common-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 3d5496449ef7ba005ede8c56a20505a1ce972287c7774e142c9e94ff2f078bce
eap7-lucene-backward-codecs-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 2381b9c4be5ddc202fe740e6782988cade752541a8509f7c06fa3e722e4531df
eap7-lucene-core-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: b7af09e7d50ec9ac1fd4e92f7a3d867c57d3159c64d12e59f388838820312cec
eap7-lucene-facet-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: a222b28410037a1b44af52e05bce9f4d71763c556c6d12fdadea73fb499e4c61
eap7-lucene-misc-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 9d83c32d466191f7f67a9c8d7c4f36dd9af795ec6efeb13f831653f993f89ed6
eap7-lucene-queries-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 5696600f0656473448066194455b9cb57a19b4915ca5862873f53c9633d8a462
eap7-lucene-queryparser-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 1f35552cfbe8b2776e0d56e0a4f8f43b1d66524e8d028a81ddefe7e992eb2469
eap7-lucene-solr-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: d7d20a75bf1ae893f66f7541de10e7fdc5cc346712a5060eaa3a064bd888b3e6

JBoss Enterprise Application Platform 7.0 for RHEL 7

SRPM
eap7-lucene-solr-5.3.1-4.redhat_2.1.ep7.el7.src.rpm	SHA-256: ef942f191ae266d33dc67e4bda83de511633eaa3423d3bd5ba2b24f833f5f1ed
x86_64
eap7-lucene-analyzers-common-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 54109b508278b969236d24543bd779923af81b3a5f62ea1fdc4cc25a0ff9dc30
eap7-lucene-backward-codecs-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 45f126d139a80b5805e3e65a20acec52e7f3b62107cbbea7672ad0d2460bc44e
eap7-lucene-core-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 1fcfe40077c326253efc07c4aec840030dc97dfd7fbf7aea1ec7e03ea4dd1eca
eap7-lucene-facet-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: b8df0b0869a6daea3d598778102cc2c12b046a06048d5697c582e10ce9338c5f
eap7-lucene-misc-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 743a65ca5650337bf22890a09b74e47a2101ae46d5c6cd1b6259e841e77db330
eap7-lucene-queries-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 863855fbe16f5e319557d36533e4e9a6ebd0857aac4e7f17548e722154e819a1
eap7-lucene-queryparser-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 8b3503ae63e2847edc3ee356a7589e27ee62cb926c35719e272f2309b3db447d
eap7-lucene-solr-5.3.1-4.redhat_2.1.ep7.el7.noarch.rpm	SHA-256: 1ff166251a7911ee2526f304e34e54edfe86604efe3b8f657cbf20591160a883

JBoss Enterprise Application Platform 7.0 for RHEL 6

SRPM
eap7-lucene-solr-5.3.1-4.redhat_2.1.ep7.el6.src.rpm	SHA-256: 28da5e0eb86ce8870211d5cf5b04be44c21837692acb5d448cd7ad3cccfe2c0c
x86_64
eap7-lucene-analyzers-common-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 3d5496449ef7ba005ede8c56a20505a1ce972287c7774e142c9e94ff2f078bce
eap7-lucene-backward-codecs-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 2381b9c4be5ddc202fe740e6782988cade752541a8509f7c06fa3e722e4531df
eap7-lucene-core-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: b7af09e7d50ec9ac1fd4e92f7a3d867c57d3159c64d12e59f388838820312cec
eap7-lucene-facet-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: a222b28410037a1b44af52e05bce9f4d71763c556c6d12fdadea73fb499e4c61
eap7-lucene-misc-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 9d83c32d466191f7f67a9c8d7c4f36dd9af795ec6efeb13f831653f993f89ed6
eap7-lucene-queries-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 5696600f0656473448066194455b9cb57a19b4915ca5862873f53c9633d8a462
eap7-lucene-queryparser-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 1f35552cfbe8b2776e0d56e0a4f8f43b1d66524e8d028a81ddefe7e992eb2469
eap7-lucene-solr-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: d7d20a75bf1ae893f66f7541de10e7fdc5cc346712a5060eaa3a064bd888b3e6
i386
eap7-lucene-analyzers-common-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 3d5496449ef7ba005ede8c56a20505a1ce972287c7774e142c9e94ff2f078bce
eap7-lucene-backward-codecs-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 2381b9c4be5ddc202fe740e6782988cade752541a8509f7c06fa3e722e4531df
eap7-lucene-core-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: b7af09e7d50ec9ac1fd4e92f7a3d867c57d3159c64d12e59f388838820312cec
eap7-lucene-facet-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: a222b28410037a1b44af52e05bce9f4d71763c556c6d12fdadea73fb499e4c61
eap7-lucene-misc-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 9d83c32d466191f7f67a9c8d7c4f36dd9af795ec6efeb13f831653f993f89ed6
eap7-lucene-queries-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 5696600f0656473448066194455b9cb57a19b4915ca5862873f53c9633d8a462
eap7-lucene-queryparser-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: 1f35552cfbe8b2776e0d56e0a4f8f43b1d66524e8d028a81ddefe7e992eb2469
eap7-lucene-solr-5.3.1-4.redhat_2.1.ep7.el6.noarch.rpm	SHA-256: d7d20a75bf1ae893f66f7541de10e7fdc5cc346712a5060eaa3a064bd888b3e6