Synopsis

Important: jboss-ec2-eap package for EAP 7.1.2

Type/Severity

Security Advisory: Important

Topic

An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise Application Platform 7.1.2 for Red Hat Enterprise Linux 6 and Red Hat JBoss Enterprise Application Platform 7.1.2 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2).

With this update, the eap7-jboss-ec2-eap package has been updated to ensure
compatibility with Red Hat JBoss Enterprise Application Platform 7.1.2.

Refer to the JBoss Enterprise Application Platform 7.1 Release Notes, linked to in the References section, for information on the most significant bug fixes and enhancements included in this release.

Security Fix(es):

• undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix
  of CVE-2016-4993) (CVE-2018-1067)
  
• wildfly-undertow: undertow: Path traversal in ServletResourceManager class
  (CVE-2018-1047)
  
• slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution (CVE-2018-8088)
  

Red Hat would like to thank Ammarit Thongthua and Nattakit Intarasorn (Deloitte Thailand Pentest team) for reporting CVE-2018-1067, and Chris McCown for reporting CVE-2018-8088.

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• JBoss Enterprise Application Platform 7.1 for RHEL 7 x86_64
• JBoss Enterprise Application Platform 7.1 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 7.1 for RHEL 6 i386

Fixes

• BZ - 1528361 - CVE-2018-1047 undertow: Path traversal in ServletResourceManager class
• BZ - 1548909 - CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution
• BZ - 1550671 - CVE-2018-1067 undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of CVE-2016-4993)

CVEs

• CVE-2018-1047
• CVE-2018-1067
• CVE-2018-8088

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/

JBoss Enterprise Application Platform 7.1 for RHEL 7

SRPM
eap7-jboss-ec2-eap-7.1.2-1.GA_redhat_1.ep7.el7.src.rpm	SHA-256: 621a0a74838157a14dfed48187f27a1d93757a39694428393c933c8c253bf908
x86_64
eap7-jboss-ec2-eap-7.1.2-1.GA_redhat_1.ep7.el7.noarch.rpm	SHA-256: 836c0e43c1aa15dc11cb84595da50d6653e9a1cc16a3c6170dd4389f29a359a4
eap7-jboss-ec2-eap-samples-7.1.2-1.GA_redhat_1.ep7.el7.noarch.rpm	SHA-256: e03f9b06c7ecb712fd66ae50cc7177471cb0ab19bc1f384f7dfd7b572bdb7eae

JBoss Enterprise Application Platform 7.1 for RHEL 6

SRPM
eap7-jboss-ec2-eap-7.1.2-1.GA_redhat_1.ep7.el6.src.rpm	SHA-256: f1dcf43f383753fc4b422748693ebb00ad483c7c30d8747488af671a0a7afe10
x86_64
eap7-jboss-ec2-eap-7.1.2-1.GA_redhat_1.ep7.el6.noarch.rpm	SHA-256: 411a5afcd745c231e4a8616fe592235ad75e0c6aa458a69bbf710a9ab7c6f372
eap7-jboss-ec2-eap-samples-7.1.2-1.GA_redhat_1.ep7.el6.noarch.rpm	SHA-256: 0fd9235d08e35e6eb3b4dbeb1fe62da832fa4ddd2691bf26dd5e54755869d16c
i386
eap7-jboss-ec2-eap-7.1.2-1.GA_redhat_1.ep7.el6.noarch.rpm	SHA-256: 411a5afcd745c231e4a8616fe592235ad75e0c6aa458a69bbf710a9ab7c6f372
eap7-jboss-ec2-eap-samples-7.1.2-1.GA_redhat_1.ep7.el6.noarch.rpm	SHA-256: 0fd9235d08e35e6eb3b4dbeb1fe62da832fa4ddd2691bf26dd5e54755869d16c