Synopsis

Critical: Red Hat JBoss Enterprise Application Platform 5.2 security update

Type/Severity

Security Advisory: Critical

Topic

A security update is now available for Red Hat JBoss Enterprise Application
Platform from the Customer Portal.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform 5.2 is a platform for Java
applications based on jbossas.

This asynchronous patch is a security update for RichFaces and Apache CXF packages in Red Hat JBoss Enterprise Application Platform 5.2.

Security Fix(es):

• Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource. (CVE-2018-12533)
  

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

The JBoss server process must be restarted for the update to take effect.

For details on how to apply this update, refer to:
https://access.redhat.com/articles/11258

Affected Products

• JBoss Enterprise Application Platform 5 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 5 for RHEL 6 i386
• JBoss Enterprise Application Platform 5 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 5 for RHEL 5 i386

Fixes

• BZ - 1584490 - CVE-2018-12533 RichFaces: Injection of arbitrary EL expressions allows remote code execution via org.richfaces.renderkit.html.Paint2DResource

CVEs

• CVE-2018-12533

References

• https://access.redhat.com/security/updates/classification/#critical
• https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/5/

JBoss Enterprise Application Platform 5 for RHEL 6

SRPM
richfaces-3.3.1-4.SP3_patch_02.ep5.el6_10.src.rpm	SHA-256: d61757c57f52962667d4393aa0e4b3f4598c9c206c3ce4dac381d0664b26cc75
x86_64
richfaces-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm	SHA-256: db938457cfb1a815eb959b02a8516418e4360c89c5bf6041c863fede69651604
richfaces-demo-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm	SHA-256: 34cd56cdcf546e9264ecd3a4b756831eb806a188663b8d6f4d0215c9a7464fb2
richfaces-framework-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm	SHA-256: 0a4e8ac142ecef3e75515e1c325035381ae80de7db677d1d1588a0844cc858eb
richfaces-root-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm	SHA-256: da0fbe0998dfa7d1f5f54dff894bd6492ed473d77a245ba7bc69429a3a5311e1
richfaces-ui-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm	SHA-256: 0ddc5e58f25beb842ee9a8756baeb71d14cd924a07324e972a40dbbe6b6ec6b6
i386
richfaces-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm	SHA-256: db938457cfb1a815eb959b02a8516418e4360c89c5bf6041c863fede69651604
richfaces-demo-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm	SHA-256: 34cd56cdcf546e9264ecd3a4b756831eb806a188663b8d6f4d0215c9a7464fb2
richfaces-framework-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm	SHA-256: 0a4e8ac142ecef3e75515e1c325035381ae80de7db677d1d1588a0844cc858eb
richfaces-root-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm	SHA-256: da0fbe0998dfa7d1f5f54dff894bd6492ed473d77a245ba7bc69429a3a5311e1
richfaces-ui-3.3.1-4.SP3_patch_02.ep5.el6_10.noarch.rpm	SHA-256: 0ddc5e58f25beb842ee9a8756baeb71d14cd924a07324e972a40dbbe6b6ec6b6

JBoss Enterprise Application Platform 5 for RHEL 5

SRPM
richfaces-3.3.1-7.SP3_patch_02.ep5.el5.src.rpm	SHA-256: 3c91633d146ef2ff9b6d47784fc405246263e7c0f85f0d8ec2f2d3dc82bb2340
x86_64
richfaces-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: 41220ae2d21dafb497ab131d0303903ebd7b59d5416f658e3a270ef99a219687
richfaces-cdk-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: 83311f39829d6d5eb271b793a43a9bcd333e945a9f64a05629c3c07c3e5c88d5
richfaces-demo-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: 4d57bc37fe4c23f08ae138723dd65aa1c2755e0c121a13107b47b989d580209d
richfaces-docs-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: f64cc70199722223c64eab320be0b0114a942a67fd6a8cecccfdfa6d3c1a5352
richfaces-framework-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: d2e5e7079e572d76cd4195a754e51f166165019f337f977e6f15fc3f2b9be058
richfaces-root-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: 2571241b541b861803d7e497a8f8a12bf2c5822971631db6492b3478dc962665
richfaces-ui-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: bdade8b0f1f8e8a6e5ae5932cb49723b17c6010dabe83574f2c38d54d0c9adbc
i386
richfaces-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: 41220ae2d21dafb497ab131d0303903ebd7b59d5416f658e3a270ef99a219687
richfaces-cdk-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: 83311f39829d6d5eb271b793a43a9bcd333e945a9f64a05629c3c07c3e5c88d5
richfaces-demo-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: 4d57bc37fe4c23f08ae138723dd65aa1c2755e0c121a13107b47b989d580209d
richfaces-docs-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: f64cc70199722223c64eab320be0b0114a942a67fd6a8cecccfdfa6d3c1a5352
richfaces-framework-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: d2e5e7079e572d76cd4195a754e51f166165019f337f977e6f15fc3f2b9be058
richfaces-root-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: 2571241b541b861803d7e497a8f8a12bf2c5822971631db6492b3478dc962665
richfaces-ui-3.3.1-7.SP3_patch_02.ep5.el5.noarch.rpm	SHA-256: bdade8b0f1f8e8a6e5ae5932cb49723b17c6010dabe83574f2c38d54d0c9adbc