Skip to navigation Skip to main content

Utilities

  • Subscriptions
  • Downloads
  • Red Hat Console
  • Get Support
Red Hat Customer Portal
  • Subscriptions
  • Downloads
  • Red Hat Console
  • Get Support
  • Products

    Top Products

    • Red Hat Enterprise Linux
    • Red Hat OpenShift
    • Red Hat Ansible Automation Platform
    All Products

    Downloads and Containers

    • Downloads
    • Packages
    • Containers

    Top Resources

    • Documentation
    • Product Life Cycles
    • Product Compliance
    • Errata
  • Knowledge

    Red Hat Knowledge Center

    • Knowledgebase Solutions
    • Knowledgebase Articles
    • Customer Portal Labs
    • Errata

    Top Product Docs

    • Red Hat Enterprise Linux
    • Red Hat OpenShift
    • Red Hat Ansible Automation Platform
    All Product Docs

    Training and Certification

    • About
    • Course Index
    • Certification Index
    • Skill Assessment
  • Security

    Red Hat Product Security Center

    • Security Updates
    • Security Advisories
    • Red Hat CVE Database
    • Errata

    References

    • Security Bulletins
    • Security Measurement
    • Severity Ratings
    • Security Data

    Top Resources

    • Security Labs
    • Backporting Policies
    • Security Blog
  • Support

    Red Hat Support

    • Support Cases
    • Troubleshoot
    • Get Support
    • Contact Red Hat Support

    Red Hat Community Support

    • Customer Portal Community
    • Community Discussions
    • Red Hat Accelerator Program

    Top Resources

    • Product Life Cycles
    • Customer Portal Labs
    • Red Hat JBoss Supported Configurations
    • Red Hat Insights
Or troubleshoot an issue.

Select Your Language

  • English
  • Français
  • 한국어
  • 日本語
  • 中文 (中国)

Infrastructure and Management

  • Red Hat Enterprise Linux
  • Red Hat Satellite
  • Red Hat Subscription Management
  • Red Hat Insights
  • Red Hat Ansible Automation Platform

Cloud Computing

  • Red Hat OpenShift
  • Red Hat OpenStack Platform
  • Red Hat OpenShift
  • Red Hat OpenShift AI
  • Red Hat OpenShift Dedicated
  • Red Hat Advanced Cluster Security for Kubernetes
  • Red Hat Advanced Cluster Management for Kubernetes
  • Red Hat Quay
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Service on AWS

Storage

  • Red Hat Gluster Storage
  • Red Hat Hyperconverged Infrastructure
  • Red Hat Ceph Storage
  • Red Hat OpenShift Data Foundation

Runtimes

  • Red Hat Runtimes
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat Data Grid
  • Red Hat JBoss Web Server
  • Red Hat build of Keycloak
  • Red Hat support for Spring Boot
  • Red Hat build of Node.js
  • Red Hat build of Quarkus

Integration and Automation

  • Red Hat Application Foundations
  • Red Hat Fuse
  • Red Hat AMQ
  • Red Hat 3scale API Management
All Products
Red Hat Product Errata RHSA-2018:3517 - Security Advisory
Issued:
2018-11-06
Updated:
2018-11-06

RHSA-2018:3517 - Security Advisory

  • Overview
  • Updated Packages

Synopsis

Critical: JBoss Enterprise Application Platform 5.2.0 security update

Type/Severity

Security Advisory: Critical

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 5 for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This asynchronous patch is a security update for the RichFaces package in Red Hat JBoss Enterprise Application Platform 5.2.

Security Fix(es):

  • RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution (CVE-2018-14667)

See https://access.redhat.com/solutions/3660371 for specific information regarding this flaw.

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Joao Filho Matos Figueiredo for reporting this issue.

Solution

Before applying this update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files) and make sure all previously-released errata relevant to your system have been applied.

Affected Products

  • JBoss Enterprise Application Platform 5 for RHEL 6 x86_64
  • JBoss Enterprise Application Platform 5 for RHEL 6 i386
  • JBoss Enterprise Application Platform 5 for RHEL 5 x86_64
  • JBoss Enterprise Application Platform 5 for RHEL 5 i386

Fixes

  • BZ - 1639139 - CVE-2018-14667 RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution
  • BZ - 1640767 - Tracker bug for the EAP 5.2.0 release for RHEL-5.

CVEs

  • CVE-2018-14667

References

  • https://access.redhat.com/security/updates/classification/#critical
  • https://access.redhat.com/solutions/3660371
  • https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/5/
Note: More recent versions of these packages may be available. Click a package name for more details.

JBoss Enterprise Application Platform 5 for RHEL 6

SRPM
richfaces-3.3.1-6.SP3_patch_03.ep5.el6.src.rpm SHA-256: 98d127a1b756680a8422eeca41d4ee0b15e47ff3c2317445d3920f82b05e38dd
x86_64
richfaces-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm SHA-256: 592c037cc9b70548ee3774e7426df3dc23bc5d2b672f1b345aca840fdfd21e44
richfaces-demo-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm SHA-256: 1a6e69ef4be3c22574c7315ed96106de7b74bf80696e04ba81ede00a0234b74c
richfaces-framework-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm SHA-256: 3732cfc2552f17e3395d66b5f5ff519d0c732bbf123c9a05cdc628afe46cc054
richfaces-root-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm SHA-256: 43945b5759bc3fb3d9116bf394f43a6cfb0a37fb6c1d33bf9c6167f072ca7a91
richfaces-ui-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm SHA-256: 4dcbee873df842e722e88f362aba5d98b60b0cd8b5becfcf7747b22d36d6214f
i386
richfaces-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm SHA-256: 592c037cc9b70548ee3774e7426df3dc23bc5d2b672f1b345aca840fdfd21e44
richfaces-demo-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm SHA-256: 1a6e69ef4be3c22574c7315ed96106de7b74bf80696e04ba81ede00a0234b74c
richfaces-framework-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm SHA-256: 3732cfc2552f17e3395d66b5f5ff519d0c732bbf123c9a05cdc628afe46cc054
richfaces-root-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm SHA-256: 43945b5759bc3fb3d9116bf394f43a6cfb0a37fb6c1d33bf9c6167f072ca7a91
richfaces-ui-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm SHA-256: 4dcbee873df842e722e88f362aba5d98b60b0cd8b5becfcf7747b22d36d6214f

JBoss Enterprise Application Platform 5 for RHEL 5

SRPM
richfaces-3.3.1-9.SP3_patch_03.ep5.el5.src.rpm SHA-256: a2a84a369cef38ca7d35d36c6b79be005fc2368773fdb8ef90a50ebc2526ee38
x86_64
richfaces-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: 5ba0d41755f609ee220ee1fdff9666a3b7344c54beeb54b3351640d68ef21124
richfaces-cdk-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: 7d4ac5b53146d9cd624722bf69240adfe234a146d23d64f81dd39c316e4aa363
richfaces-demo-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: ee54aab80ce6c809d36a1fc9397d6f09e714685b03dfebab3ab29522cb5879a1
richfaces-docs-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: 2dd7184235013ec1656e00f5128a3c094b7f02bd5e3bc449304a30e2a0acfc47
richfaces-framework-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: ecbb3ac948e4b31f8e85c14c14e6de8ca4a5f2cc9b2c730e260fcf5221e12a60
richfaces-root-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: add7d200012e2c960a74e5e71a6be69d9050db40d28b0f12fae129eca00e66d2
richfaces-ui-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: 80fc0c69a442be8e6488eb8eff9e68002dfc477beacfbfdad5920acadec2ef75
i386
richfaces-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: 5ba0d41755f609ee220ee1fdff9666a3b7344c54beeb54b3351640d68ef21124
richfaces-cdk-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: 7d4ac5b53146d9cd624722bf69240adfe234a146d23d64f81dd39c316e4aa363
richfaces-demo-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: ee54aab80ce6c809d36a1fc9397d6f09e714685b03dfebab3ab29522cb5879a1
richfaces-docs-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: 2dd7184235013ec1656e00f5128a3c094b7f02bd5e3bc449304a30e2a0acfc47
richfaces-framework-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: ecbb3ac948e4b31f8e85c14c14e6de8ca4a5f2cc9b2c730e260fcf5221e12a60
richfaces-root-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: add7d200012e2c960a74e5e71a6be69d9050db40d28b0f12fae129eca00e66d2
richfaces-ui-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm SHA-256: 80fc0c69a442be8e6488eb8eff9e68002dfc477beacfbfdad5920acadec2ef75

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.

Red Hat LinkedIn YouTube Facebook X, formerly Twitter

Quick Links

  • Downloads
  • Subscriptions
  • Support Cases
  • Customer Service
  • Product Documentation

Help

  • Contact Us
  • Customer Portal FAQ
  • Log-in Assistance

Site Info

  • Trust Red Hat
  • Browser Support Policy
  • Accessibility
  • Awards and Recognition
  • Colophon

Related Sites

  • redhat.com
  • developers.redhat.com
  • connect.redhat.com
  • cloud.redhat.com

Red Hat legal and privacy links

  • About Red Hat
  • Jobs
  • Events
  • Locations
  • Contact Red Hat
  • Red Hat Blog
  • Inclusion at Red Hat
  • Cool Stuff Store
  • Red Hat Summit
© 2025 Red Hat

Red Hat legal and privacy links

  • Privacy statement
  • Terms of use
  • All policies and guidelines
  • Digital accessibility