红帽产品勘误 RHSA-2018:2664 - Security Advisory
发布：
2018-09-10
已更新：
2018-09-10

RHSA-2018:2664 - Security Advisory

概述

Critical: Red Hat JBoss Enterprise Application Platform 5.2 security update

类型/严重性

Security Advisory: Critical

Red Hat Lightspeed patch analysis

识别并修复受此公告影响的系统。

查看受影响的系统

标题

A security update is now available for Red Hat JBoss Enterprise Application
Platform from the Customer Portal.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

描述

Red Hat JBoss Enterprise Application Platform 5.2 is a platform for Java
applications based on jbossas.

This asynchronous patch is a security update for RichFaces and Apache CXF packages in Red Hat JBoss Enterprise Application Platform 5.2.

Security Fix(es):

  • Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource. (CVE-2018-12533)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

解决方案

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

The JBoss server process must be restarted for the update to take effect.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258

受影响的产品

  • JBoss Enterprise Application Platform 5 for RHEL 6 x86_64
  • JBoss Enterprise Application Platform 5 for RHEL 6 i386
  • JBoss Enterprise Application Platform 5 for RHEL 5 x86_64
  • JBoss Enterprise Application Platform 5 for RHEL 5 i386

修复

  • BZ - 1584490 - CVE-2018-12533 RichFaces: Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource

JBoss Enterprise Application Platform 5 for RHEL 6

SRPM
richfaces-3.3.1-4.SP3_patch_02.ep5.el6_10.src.rpm SHA-256: d61757c57f52962667d4393aa0e4b3f4598c9c206c3ce4dac381d0664b26cc75
x86_64
richfaces-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm SHA-256: db938457cfb1a815eb959b02a8516418e4360c89c5bf6041c863fede69651604
richfaces-demo-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm SHA-256: 34cd56cdcf546e9264ecd3a4b756831eb806a188663b8d6f4d0215c9a7464fb2
richfaces-framework-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm SHA-256: 0a4e8ac142ecef3e75515e1c325035381ae80de7db677d1d1588a0844cc858eb
richfaces-root-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm SHA-256: da0fbe0998dfa7d1f5f54dff894bd6492ed473d77a245ba7bc69429a3a5311e1
richfaces-ui-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm SHA-256: 0ddc5e58f25beb842ee9a8756baeb71d14cd924a07324e972a40dbbe6b6ec6b6
i386
richfaces-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm SHA-256: db938457cfb1a815eb959b02a8516418e4360c89c5bf6041c863fede69651604
richfaces-demo-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm SHA-256: 34cd56cdcf546e9264ecd3a4b756831eb806a188663b8d6f4d0215c9a7464fb2
richfaces-framework-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm SHA-256: 0a4e8ac142ecef3e75515e1c325035381ae80de7db677d1d1588a0844cc858eb
richfaces-root-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm SHA-256: da0fbe0998dfa7d1f5f54dff894bd6492ed473d77a245ba7bc69429a3a5311e1
richfaces-ui-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm SHA-256: 0ddc5e58f25beb842ee9a8756baeb71d14cd924a07324e972a40dbbe6b6ec6b6

JBoss Enterprise Application Platform 5 for RHEL 5

SRPM
richfaces-3.3.1-7.SP3_patch_02.ep5.el5.src.rpm SHA-256: 3c91633d146ef2ff9b6d47784fc405246263e7c0f85f0d8ec2f2d3dc82bb2340
x86_64
richfaces-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: 41220ae2d21dafb497ab131d0303903ebd7b59d5416f658e3a270ef99a219687
richfaces-cdk-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: 83311f39829d6d5eb271b793a43a9bcd333e945a9f64a05629c3c07c3e5c88d5
richfaces-demo-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: 4d57bc37fe4c23f08ae138723dd65aa1c2755e0c121a13107b47b989d580209d
richfaces-docs-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: f64cc70199722223c64eab320be0b0114a942a67fd6a8cecccfdfa6d3c1a5352
richfaces-framework-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: d2e5e7079e572d76cd4195a754e51f166165019f337f977e6f15fc3f2b9be058
richfaces-root-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: 2571241b541b861803d7e497a8f8a12bf2c5822971631db6492b3478dc962665
richfaces-ui-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: bdade8b0f1f8e8a6e5ae5932cb49723b17c6010dabe83574f2c38d54d0c9adbc
i386
richfaces-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: 41220ae2d21dafb497ab131d0303903ebd7b59d5416f658e3a270ef99a219687
richfaces-cdk-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: 83311f39829d6d5eb271b793a43a9bcd333e945a9f64a05629c3c07c3e5c88d5
richfaces-demo-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: 4d57bc37fe4c23f08ae138723dd65aa1c2755e0c121a13107b47b989d580209d
richfaces-docs-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: f64cc70199722223c64eab320be0b0114a942a67fd6a8cecccfdfa6d3c1a5352
richfaces-framework-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: d2e5e7079e572d76cd4195a754e51f166165019f337f977e6f15fc3f2b9be058
richfaces-root-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: 2571241b541b861803d7e497a8f8a12bf2c5822971631db6492b3478dc962665
richfaces-ui-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm SHA-256: bdade8b0f1f8e8a6e5ae5932cb49723b17c6010dabe83574f2c38d54d0c9adbc

Red Hat 安全团队联络方式为 secalert@redhat.com。 更多联络细节请参考 https://access.redhat.com/security/team/contact/。