Synopsis

Critical: JBoss Enterprise Application Platform 5.2.0 security update

Type/Severity

Security Advisory: Critical

Topic

An update is now available for Red Hat JBoss Enterprise Application Platform 5 for Red Hat Enterprise Linux 5.

Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.

This asynchronous patch is a security update for the RichFaces package in Red Hat JBoss Enterprise Application Platform 5.2.

Security Fix(es):

• RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution (CVE-2018-14667)
  

See https://access.redhat.com/solutions/3660371 for specific information regarding this flaw.

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Joao Filho Matos Figueiredo for reporting this issue.

Solution

Before applying this update, back up your existing JBoss Enterprise Application Platform installation (including all applications and configuration files) and make sure all previously-released errata relevant to your system have been applied.

Affected Products

• JBoss Enterprise Application Platform 5 for RHEL 6 x86_64
• JBoss Enterprise Application Platform 5 for RHEL 6 i386
• JBoss Enterprise Application Platform 5 for RHEL 5 x86_64
• JBoss Enterprise Application Platform 5 for RHEL 5 i386

Fixes

• BZ - 1639139 - CVE-2018-14667 RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution
• BZ - 1640767 - Tracker bug for the EAP 5.2.0 release for RHEL-5.

CVEs

• CVE-2018-14667

References

• https://access.redhat.com/security/updates/classification/#critical
• https://access.redhat.com/solutions/3660371
• https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/5/

JBoss Enterprise Application Platform 5 for RHEL 6

SRPM
richfaces-3.3.1-6.SP3_patch_03.ep5.el6.src.rpm	SHA-256: 98d127a1b756680a8422eeca41d4ee0b15e47ff3c2317445d3920f82b05e38dd
x86_64
richfaces-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm	SHA-256: 592c037cc9b70548ee3774e7426df3dc23bc5d2b672f1b345aca840fdfd21e44
richfaces-demo-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm	SHA-256: 1a6e69ef4be3c22574c7315ed96106de7b74bf80696e04ba81ede00a0234b74c
richfaces-framework-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm	SHA-256: 3732cfc2552f17e3395d66b5f5ff519d0c732bbf123c9a05cdc628afe46cc054
richfaces-root-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm	SHA-256: 43945b5759bc3fb3d9116bf394f43a6cfb0a37fb6c1d33bf9c6167f072ca7a91
richfaces-ui-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm	SHA-256: 4dcbee873df842e722e88f362aba5d98b60b0cd8b5becfcf7747b22d36d6214f
i386
richfaces-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm	SHA-256: 592c037cc9b70548ee3774e7426df3dc23bc5d2b672f1b345aca840fdfd21e44
richfaces-demo-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm	SHA-256: 1a6e69ef4be3c22574c7315ed96106de7b74bf80696e04ba81ede00a0234b74c
richfaces-framework-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm	SHA-256: 3732cfc2552f17e3395d66b5f5ff519d0c732bbf123c9a05cdc628afe46cc054
richfaces-root-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm	SHA-256: 43945b5759bc3fb3d9116bf394f43a6cfb0a37fb6c1d33bf9c6167f072ca7a91
richfaces-ui-3.3.1-6.SP3_patch_03.ep5.el6.noarch.rpm	SHA-256: 4dcbee873df842e722e88f362aba5d98b60b0cd8b5becfcf7747b22d36d6214f

JBoss Enterprise Application Platform 5 for RHEL 5

SRPM
richfaces-3.3.1-9.SP3_patch_03.ep5.el5.src.rpm	SHA-256: a2a84a369cef38ca7d35d36c6b79be005fc2368773fdb8ef90a50ebc2526ee38
x86_64
richfaces-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: 5ba0d41755f609ee220ee1fdff9666a3b7344c54beeb54b3351640d68ef21124
richfaces-cdk-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: 7d4ac5b53146d9cd624722bf69240adfe234a146d23d64f81dd39c316e4aa363
richfaces-demo-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: ee54aab80ce6c809d36a1fc9397d6f09e714685b03dfebab3ab29522cb5879a1
richfaces-docs-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: 2dd7184235013ec1656e00f5128a3c094b7f02bd5e3bc449304a30e2a0acfc47
richfaces-framework-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: ecbb3ac948e4b31f8e85c14c14e6de8ca4a5f2cc9b2c730e260fcf5221e12a60
richfaces-root-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: add7d200012e2c960a74e5e71a6be69d9050db40d28b0f12fae129eca00e66d2
richfaces-ui-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: 80fc0c69a442be8e6488eb8eff9e68002dfc477beacfbfdad5920acadec2ef75
i386
richfaces-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: 5ba0d41755f609ee220ee1fdff9666a3b7344c54beeb54b3351640d68ef21124
richfaces-cdk-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: 7d4ac5b53146d9cd624722bf69240adfe234a146d23d64f81dd39c316e4aa363
richfaces-demo-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: ee54aab80ce6c809d36a1fc9397d6f09e714685b03dfebab3ab29522cb5879a1
richfaces-docs-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: 2dd7184235013ec1656e00f5128a3c094b7f02bd5e3bc449304a30e2a0acfc47
richfaces-framework-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: ecbb3ac948e4b31f8e85c14c14e6de8ca4a5f2cc9b2c730e260fcf5221e12a60
richfaces-root-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: add7d200012e2c960a74e5e71a6be69d9050db40d28b0f12fae129eca00e66d2
richfaces-ui-3.3.1-9.SP3_patch_03.ep5.el5.noarch.rpm	SHA-256: 80fc0c69a442be8e6488eb8eff9e68002dfc477beacfbfdad5920acadec2ef75