Red Hat Product Errata RHSA-2018:3768 - Security Advisory
Issued:
2018-12-04
Updated:
2018-12-04

RHSA-2018:3768 - Security Advisory

Synopsis

Important: Red Hat Fuse 7.2 security update

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat Fuse.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Fuse enables integration experts, application developers, and business users to collaborate and independently develop connected solutions.

Fuse is part of an agile integration solution. Its distributed approach allows teams to deploy integrated services where required. The API-centric, container-based architecture decouples services so they can be created, extended, and deployed independently.

This release of Red Hat Fuse 7.2 serves as a replacement for Red Hat Fuse 7.1, and includes bug fixes and enhancements, which are documented in the Release Notes document linked to in the References.

Security Fix(es):

  • xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag (CVE-2016-5003)
  • tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336)
  • ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint (CVE-2018-8018)
  • apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)
  • xmlrpc: XML external entity vulnerability SSRF via a crafted DTD (CVE-2016-5002)
  • undertow: Client can use bogus uri in Digest authentication (CVE-2017-12196)
  • spring-data-commons: XXE with Spring Data’s XMLBeam integration (CVE-2018-1259)
  • kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass (CVE-2018-1288)
  • tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins (CVE-2018-8014)
  • camel-mail: path traversal vulnerability (CVE-2018-8041)
  • vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers (CVE-2018-12537)
  • spring-framework: ReDoS Attack with spring-messaging (CVE-2018-1257)

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Eedo Shapira (GE Digital) for reporting CVE-2018-8041. The CVE-2017-12196 issue was discovered by Jan Stourac (Red Hat).

Solution

Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are located in the download section of the customer portal.

The References section of this erratum contains a download link (you must log in to download the update).

Affected Products

  • Red Hat Fuse 1 x86_64

Fixes

  • BZ - 1503055 - CVE-2017-12196 undertow: Client can use bogus uri in Digest authentication
  • BZ - 1508110 - CVE-2016-5002 xmlrpc: XML external entity vulnerability SSRF via a crafted DTD
  • BZ - 1508123 - CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
  • BZ - 1578578 - CVE-2018-1257 spring-framework: ReDoS Attack with spring-messaging
  • BZ - 1578902 - CVE-2018-1259 spring-data-commons: XXE with Spring Data’s XMLBeam integration
  • BZ - 1579611 - CVE-2018-8014 tomcat: Insecure defaults in CORS filter enable 'supportsCredentials' for all origins
  • BZ - 1591072 - CVE-2018-12537 vertx: Improper neutralization of CRLF sequences allows remote attackers to inject arbitrary HTTP response headers
  • BZ - 1595332 - CVE-2018-8039 apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*
  • BZ - 1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS
  • BZ - 1607731 - CVE-2018-8018 ignite: Improper deserialization allows for code execution via GridClientJdkMarshaller endpoint
  • BZ - 1611059 - CVE-2018-1288 kafka: Users can perform Broker actions via crafted fetch requests, interfering with data replication and causing data lass
  • BZ - 1612644 - CVE-2018-8041 camel-mail: path traversal vulnerability

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.