Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2017.2217
Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update
6 September 2017
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: JBoss
Publisher: Red Hat
Operating System: Red Hat
Impact/Access: Execute Arbitrary Code/Commands -- Remote/Unauthenticated
Provide Misleading Information -- Remote/Unauthenticated
Resolution: Patch/Upgrade
CVE Names: CVE-2017-7525 CVE-2017-5664 CVE-2017-5645
Reference: ESB-2017.2156
ESB-2017.2153
ESB-2017.2091
ESB-2017.2034
Original Bulletin:
https://access.redhat.com/errata/RHSA-2017:2633
https://access.redhat.com/errata/RHSA-2017:2635
https://access.redhat.com/errata/RHSA-2017:2636
https://access.redhat.com/errata/RHSA-2017:2637
https://access.redhat.com/errata/RHSA-2017:2638
Comment: This bulletin contains five (5) Red Hat security advisories.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update
Advisory ID: RHSA-2017:2633-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:2633
Issue date: 2017-09-05
CVE Names: CVE-2017-5645 CVE-2017-5664 CVE-2017-7525
=====================================================================
1. Summary:
An update is now available for Red Hat JBoss Enterprise Application
Platform 6.4.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.
This release of Red Hat JBoss Enterprise Application Platform 6.4.17 serves
as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.16,
and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* It was found that when using remote logging with log4j socket server the
log4j server would deserialize any log event received via TCP or UDP. An
attacker could use this flaw to send a specially crafted log event that,
during deserialization, would execute arbitrary code in the context of the
logger application. (CVE-2017-5645)
* A vulnerability was discovered in the error page mechanism in Tomcat's
DefaultServlet implementation. A crafted HTTP request could cause undesired
side effects, possibly including the removal or replacement of the custom
error page. (CVE-2017-5664)
* A deserialization flaw was discovered in the jackson-databind which could
allow an unauthenticated user to perform code execution by sending the
maliciously crafted input to the readValue method of the ObjectMapper.
(CVE-2017-7525)
Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting
CVE-2017-7525.
3. Solution:
Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.
The References section of this erratum contains a download link (you must
log in to download the update).
4. Bugs fixed (https://bugzilla.redhat.com/):
1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability
1459158 - CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
5. References:
https://access.redhat.com/security/cve/CVE-2017-5645
https://access.redhat.com/security/cve/CVE-2017-5664
https://access.redhat.com/security/cve/CVE-2017-7525
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform?version=6.4/
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=6.4
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFZrrYqXlSAg2UNWIIRAmsOAKCmGpHhb85mBI5cs7gRNnu98HqaawCgqO3E
4ySwlUtUXAX9y4Eho968E7s=
=pjKj
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 6
Advisory ID: RHSA-2017:2635-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:2635
Issue date: 2017-09-05
CVE Names: CVE-2017-5645 CVE-2017-5664 CVE-2017-7525
=====================================================================
1. Summary:
An update is now available for Red Hat JBoss Enterprise Application
Platform 6.4 for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server - noarch
3. Description:
Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.
This release of Red Hat JBoss Enterprise Application Platform 6.4.17 serves
as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.16,
and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* It was found that when using remote logging with log4j socket server the
log4j server would deserialize any log event received via TCP or UDP. An
attacker could use this flaw to send a specially crafted log event that,
during deserialization, would execute arbitrary code in the context of the
logger application. (CVE-2017-5645)
* A vulnerability was discovered in the error page mechanism in Tomcat's
DefaultServlet implementation. A crafted HTTP request could cause undesired
side effects, possibly including the removal or replacement of the custom
error page. (CVE-2017-5664)
* A deserialization flaw was discovered in the jackson-databind which could
allow an unauthenticated user to perform code execution by sending the
maliciously crafted input to the readValue method of the ObjectMapper.
(CVE-2017-7525)
Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting
CVE-2017-7525.
4. Solution:
Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability
1459158 - CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
6. Package List:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server:
Source:
apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el6.src.rpm
codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el6.src.rpm
hibernate4-eap6-4.2.27-1.Final_redhat_1.1.ep6.el6.src.rpm
hornetq-2.3.25-22.SP20_redhat_1.1.ep6.el6.src.rpm
infinispan-5.2.22-1.Final_redhat_1.1.ep6.el6.src.rpm
jboss-as-appclient-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-cli-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-client-all-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-clustering-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-cmp-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-connector-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-controller-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-controller-client-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-core-security-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-deployment-repository-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-deployment-scanner-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-domain-http-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-domain-management-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-ee-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-ee-deployment-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-ejb3-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-embedded-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-host-controller-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-jacorb-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-jaxr-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-jaxrs-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-jdr-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-jmx-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-jpa-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-jsf-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-jsr77-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-logging-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-mail-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-management-client-content-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-messaging-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-modcluster-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-naming-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-network-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-osgi-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-osgi-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-osgi-service-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-picketlink-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-platform-mbean-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-pojo-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-process-controller-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-protocol-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-remoting-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-sar-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-security-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-server-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-system-jmx-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-threads-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-transactions-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-version-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-web-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-webservices-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-weld-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-as-xts-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jboss-marshalling-1.4.10-3.SP3_redhat_1.1.ep6.el6.src.rpm
jboss-metadata-7.2.3-1.Final_redhat_1.1.ep6.el6.src.rpm
jboss-modules-1.3.10-1.Final_redhat_1.1.ep6.el6.src.rpm
jboss-remoting3-3.3.10-1.Final_redhat_1.1.ep6.el6.src.rpm
jboss-vfs2-3.2.12-1.Final_redhat_1.1.ep6.el6.src.rpm
jbossas-appclient-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jbossas-bundles-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jbossas-core-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jbossas-domain-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jbossas-javadocs-7.5.17-4.Final_redhat_4.1.ep6.el6.src.rpm
jbossas-modules-eap-7.5.17-1.Final_redhat_4.1.ep6.el6.src.rpm
jbossas-product-eap-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jbossas-standalone-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jbossas-welcome-content-eap-7.5.17-2.Final_redhat_4.1.ep6.el6.src.rpm
jbossweb-7.5.24-1.Final_redhat_1.1.ep6.el6.src.rpm
log4j-eap6-1.2.16-12.redhat_3.1.ep6.el6.src.rpm
log4j-jboss-logmanager-1.1.4-1.Final_redhat_1.1.ep6.el6.src.rpm
picketlink-bindings-2.5.4-17.SP15_redhat_1.1.ep6.el6.src.rpm
picketlink-federation-2.5.4-17.SP15_redhat_1.1.ep6.el6.src.rpm
noarch:
apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el6.noarch.rpm
codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el6.noarch.rpm
codehaus-jackson-core-asl-1.9.9-11.redhat_5.1.ep6.el6.noarch.rpm
codehaus-jackson-jaxrs-1.9.9-11.redhat_5.1.ep6.el6.noarch.rpm
codehaus-jackson-mapper-asl-1.9.9-11.redhat_5.1.ep6.el6.noarch.rpm
codehaus-jackson-xc-1.9.9-11.redhat_5.1.ep6.el6.noarch.rpm
hibernate4-core-eap6-4.2.27-1.Final_redhat_1.1.ep6.el6.noarch.rpm
hibernate4-eap6-4.2.27-1.Final_redhat_1.1.ep6.el6.noarch.rpm
hibernate4-entitymanager-eap6-4.2.27-1.Final_redhat_1.1.ep6.el6.noarch.rpm
hibernate4-envers-eap6-4.2.27-1.Final_redhat_1.1.ep6.el6.noarch.rpm
hibernate4-infinispan-eap6-4.2.27-1.Final_redhat_1.1.ep6.el6.noarch.rpm
hornetq-2.3.25-22.SP20_redhat_1.1.ep6.el6.noarch.rpm
infinispan-5.2.22-1.Final_redhat_1.1.ep6.el6.noarch.rpm
infinispan-cachestore-jdbc-5.2.22-1.Final_redhat_1.1.ep6.el6.noarch.rpm
infinispan-cachestore-remote-5.2.22-1.Final_redhat_1.1.ep6.el6.noarch.rpm
infinispan-client-hotrod-5.2.22-1.Final_redhat_1.1.ep6.el6.noarch.rpm
infinispan-core-5.2.22-1.Final_redhat_1.1.ep6.el6.noarch.rpm
jboss-as-appclient-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-cli-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-client-all-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-clustering-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-cmp-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-connector-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-controller-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-controller-client-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-core-security-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-deployment-repository-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-deployment-scanner-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-domain-http-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-domain-management-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-ee-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-ee-deployment-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-ejb3-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-embedded-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-host-controller-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-jacorb-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-jaxr-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-jaxrs-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-jdr-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-jmx-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-jpa-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-jsf-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-jsr77-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-logging-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-mail-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-management-client-content-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-messaging-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-modcluster-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-naming-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-network-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-osgi-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-osgi-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-osgi-service-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-picketlink-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-platform-mbean-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-pojo-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-process-controller-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-protocol-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-remoting-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-sar-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-security-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-server-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-system-jmx-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-threads-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-transactions-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-version-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-web-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-webservices-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-weld-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-as-xts-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jboss-marshalling-1.4.10-3.SP3_redhat_1.1.ep6.el6.noarch.rpm
jboss-metadata-7.2.3-1.Final_redhat_1.1.ep6.el6.noarch.rpm
jboss-metadata-appclient-7.2.3-1.Final_redhat_1.1.ep6.el6.noarch.rpm
jboss-metadata-common-7.2.3-1.Final_redhat_1.1.ep6.el6.noarch.rpm
jboss-metadata-ear-7.2.3-1.Final_redhat_1.1.ep6.el6.noarch.rpm
jboss-metadata-ejb-7.2.3-1.Final_redhat_1.1.ep6.el6.noarch.rpm
jboss-metadata-web-7.2.3-1.Final_redhat_1.1.ep6.el6.noarch.rpm
jboss-modules-1.3.10-1.Final_redhat_1.1.ep6.el6.noarch.rpm
jboss-remoting3-3.3.10-1.Final_redhat_1.1.ep6.el6.noarch.rpm
jboss-vfs2-3.2.12-1.Final_redhat_1.1.ep6.el6.noarch.rpm
jbossas-appclient-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jbossas-bundles-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jbossas-core-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jbossas-domain-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jbossas-javadocs-7.5.17-4.Final_redhat_4.1.ep6.el6.noarch.rpm
jbossas-modules-eap-7.5.17-1.Final_redhat_4.1.ep6.el6.noarch.rpm
jbossas-product-eap-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jbossas-standalone-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jbossas-welcome-content-eap-7.5.17-2.Final_redhat_4.1.ep6.el6.noarch.rpm
jbossweb-7.5.24-1.Final_redhat_1.1.ep6.el6.noarch.rpm
log4j-eap6-1.2.16-12.redhat_3.1.ep6.el6.noarch.rpm
log4j-jboss-logmanager-1.1.4-1.Final_redhat_1.1.ep6.el6.noarch.rpm
picketlink-bindings-2.5.4-17.SP15_redhat_1.1.ep6.el6.noarch.rpm
picketlink-federation-2.5.4-17.SP15_redhat_1.1.ep6.el6.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2017-5645
https://access.redhat.com/security/cve/CVE-2017-5664
https://access.redhat.com/security/cve/CVE-2017-7525
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform?version=6.4/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFZrr+SXlSAg2UNWIIRAmIaAJ92Gzhnj3kccdXSQXceMzwj7AVN+ACgn58p
RlBOADGrOEV4aHfExTaLr2A=
=qGZH
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 7
Advisory ID: RHSA-2017:2636-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:2636
Issue date: 2017-09-05
CVE Names: CVE-2017-5645 CVE-2017-5664 CVE-2017-7525
=====================================================================
1. Summary:
An update is now available for Red Hat JBoss Enterprise Application
Platform 6.4 for Red Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server - noarch
3. Description:
Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.
This release of Red Hat JBoss Enterprise Application Platform 6.4.17 serves
as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.16,
and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* It was found that when using remote logging with log4j socket server the
log4j server would deserialize any log event received via TCP or UDP. An
attacker could use this flaw to send a specially crafted log event that,
during deserialization, would execute arbitrary code in the context of the
logger application. (CVE-2017-5645)
* A vulnerability was discovered in the error page mechanism in Tomcat's
DefaultServlet implementation. A crafted HTTP request could cause undesired
side effects, possibly including the removal or replacement of the custom
error page. (CVE-2017-5664)
* A deserialization flaw was discovered in the jackson-databind which could
allow an unauthenticated user to perform code execution by sending the
maliciously crafted input to the readValue method of the ObjectMapper.
(CVE-2017-7525)
Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting
CVE-2017-7525.
4. Solution:
Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability
1459158 - CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
6. Package List:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 7 Server:
Source:
apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el7.src.rpm
codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el7.src.rpm
hibernate4-eap6-4.2.27-1.Final_redhat_1.1.ep6.el7.src.rpm
hornetq-2.3.25-22.SP20_redhat_1.1.ep6.el7.src.rpm
infinispan-5.2.22-1.Final_redhat_1.1.ep6.el7.src.rpm
jboss-as-appclient-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-cli-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-client-all-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-clustering-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-cmp-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-connector-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-controller-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-controller-client-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-core-security-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-deployment-repository-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-deployment-scanner-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-domain-http-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-domain-management-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-ee-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-ee-deployment-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-ejb3-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-embedded-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-host-controller-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-jacorb-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-jaxr-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-jaxrs-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-jdr-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-jmx-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-jpa-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-jsf-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-jsr77-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-logging-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-mail-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-management-client-content-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-messaging-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-modcluster-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-naming-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-network-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-osgi-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-osgi-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-osgi-service-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-picketlink-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-platform-mbean-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-pojo-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-process-controller-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-protocol-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-remoting-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-sar-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-security-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-server-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-system-jmx-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-threads-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-transactions-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-version-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-web-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-webservices-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-weld-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-as-xts-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jboss-marshalling-1.4.10-3.SP3_redhat_1.1.ep6.el7.src.rpm
jboss-metadata-7.2.3-1.Final_redhat_1.1.ep6.el7.src.rpm
jboss-modules-1.3.10-1.Final_redhat_1.1.ep6.el7.src.rpm
jboss-remoting3-3.3.10-1.Final_redhat_1.1.ep6.el7.src.rpm
jboss-vfs2-3.2.12-1.Final_redhat_1.1.ep6.el7.src.rpm
jbossas-appclient-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jbossas-bundles-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jbossas-core-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jbossas-domain-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jbossas-javadocs-7.5.17-4.Final_redhat_4.1.ep6.el7.src.rpm
jbossas-modules-eap-7.5.17-1.Final_redhat_4.1.ep6.el7.src.rpm
jbossas-product-eap-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jbossas-standalone-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jbossas-welcome-content-eap-7.5.17-2.Final_redhat_4.1.ep6.el7.src.rpm
jbossweb-7.5.24-1.Final_redhat_1.1.ep6.el7.src.rpm
log4j-eap6-1.2.16-12.redhat_3.1.ep6.el7.src.rpm
log4j-jboss-logmanager-1.1.4-1.Final_redhat_1.1.ep6.el7.src.rpm
picketlink-bindings-2.5.4-17.SP15_redhat_1.1.ep6.el7.src.rpm
picketlink-federation-2.5.4-17.SP15_redhat_1.1.ep6.el7.src.rpm
noarch:
apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el7.noarch.rpm
codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el7.noarch.rpm
codehaus-jackson-core-asl-1.9.9-11.redhat_5.1.ep6.el7.noarch.rpm
codehaus-jackson-jaxrs-1.9.9-11.redhat_5.1.ep6.el7.noarch.rpm
codehaus-jackson-mapper-asl-1.9.9-11.redhat_5.1.ep6.el7.noarch.rpm
codehaus-jackson-xc-1.9.9-11.redhat_5.1.ep6.el7.noarch.rpm
hibernate4-core-eap6-4.2.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm
hibernate4-eap6-4.2.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm
hibernate4-entitymanager-eap6-4.2.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm
hibernate4-envers-eap6-4.2.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm
hibernate4-infinispan-eap6-4.2.27-1.Final_redhat_1.1.ep6.el7.noarch.rpm
hornetq-2.3.25-22.SP20_redhat_1.1.ep6.el7.noarch.rpm
infinispan-5.2.22-1.Final_redhat_1.1.ep6.el7.noarch.rpm
infinispan-cachestore-jdbc-5.2.22-1.Final_redhat_1.1.ep6.el7.noarch.rpm
infinispan-cachestore-remote-5.2.22-1.Final_redhat_1.1.ep6.el7.noarch.rpm
infinispan-client-hotrod-5.2.22-1.Final_redhat_1.1.ep6.el7.noarch.rpm
infinispan-core-5.2.22-1.Final_redhat_1.1.ep6.el7.noarch.rpm
jboss-as-appclient-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-cli-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-client-all-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-clustering-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-cmp-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-connector-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-controller-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-controller-client-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-core-security-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-deployment-repository-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-deployment-scanner-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-domain-http-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-domain-management-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-ee-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-ee-deployment-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-ejb3-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-embedded-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-host-controller-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-jacorb-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-jaxr-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-jaxrs-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-jdr-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-jmx-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-jpa-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-jsf-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-jsr77-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-logging-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-mail-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-management-client-content-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-messaging-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-modcluster-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-naming-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-network-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-osgi-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-osgi-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-osgi-service-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-picketlink-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-platform-mbean-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-pojo-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-process-controller-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-protocol-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-remoting-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-sar-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-security-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-server-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-system-jmx-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-threads-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-transactions-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-version-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-web-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-webservices-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-weld-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-as-xts-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jboss-marshalling-1.4.10-3.SP3_redhat_1.1.ep6.el7.noarch.rpm
jboss-metadata-7.2.3-1.Final_redhat_1.1.ep6.el7.noarch.rpm
jboss-metadata-appclient-7.2.3-1.Final_redhat_1.1.ep6.el7.noarch.rpm
jboss-metadata-common-7.2.3-1.Final_redhat_1.1.ep6.el7.noarch.rpm
jboss-metadata-ear-7.2.3-1.Final_redhat_1.1.ep6.el7.noarch.rpm
jboss-metadata-ejb-7.2.3-1.Final_redhat_1.1.ep6.el7.noarch.rpm
jboss-metadata-web-7.2.3-1.Final_redhat_1.1.ep6.el7.noarch.rpm
jboss-modules-1.3.10-1.Final_redhat_1.1.ep6.el7.noarch.rpm
jboss-remoting3-3.3.10-1.Final_redhat_1.1.ep6.el7.noarch.rpm
jboss-vfs2-3.2.12-1.Final_redhat_1.1.ep6.el7.noarch.rpm
jbossas-appclient-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jbossas-bundles-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jbossas-core-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jbossas-domain-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jbossas-javadocs-7.5.17-4.Final_redhat_4.1.ep6.el7.noarch.rpm
jbossas-modules-eap-7.5.17-1.Final_redhat_4.1.ep6.el7.noarch.rpm
jbossas-product-eap-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jbossas-standalone-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jbossas-welcome-content-eap-7.5.17-2.Final_redhat_4.1.ep6.el7.noarch.rpm
jbossweb-7.5.24-1.Final_redhat_1.1.ep6.el7.noarch.rpm
log4j-eap6-1.2.16-12.redhat_3.1.ep6.el7.noarch.rpm
log4j-jboss-logmanager-1.1.4-1.Final_redhat_1.1.ep6.el7.noarch.rpm
picketlink-bindings-2.5.4-17.SP15_redhat_1.1.ep6.el7.noarch.rpm
picketlink-federation-2.5.4-17.SP15_redhat_1.1.ep6.el7.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2017-5645
https://access.redhat.com/security/cve/CVE-2017-5664
https://access.redhat.com/security/cve/CVE-2017-7525
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform?version=6.4/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFZrr7bXlSAg2UNWIIRAgw+AJ9wo22OKJkt8q0LeFjEnNRHRrjuuwCgvOGz
ZDsqvWY/822G5+TtBIoOdC8=
=JtoI
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: Red Hat JBoss Enterprise Application Platform 6.4.17 update on RHEL 5
Advisory ID: RHSA-2017:2637-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:2637
Issue date: 2017-09-05
CVE Names: CVE-2017-5645 CVE-2017-5664 CVE-2017-7525
=====================================================================
1. Summary:
An update is now available for Red Hat JBoss Enterprise Application
Platform 6.4 for Red Hat Enterprise Linux 5.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server - noarch
3. Description:
Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.
This release of Red Hat JBoss Enterprise Application Platform 6.4.17 serves
as a replacement for Red Hat JBoss Enterprise Application Platform 6.4.16,
and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* It was found that when using remote logging with log4j socket server the
log4j server would deserialize any log event received via TCP or UDP. An
attacker could use this flaw to send a specially crafted log event that,
during deserialization, would execute arbitrary code in the context of the
logger application. (CVE-2017-5645)
* A vulnerability was discovered in the error page mechanism in Tomcat's
DefaultServlet implementation. A crafted HTTP request could cause undesired
side effects, possibly including the removal or replacement of the custom
error page. (CVE-2017-5664)
* A deserialization flaw was discovered in the jackson-databind which could
allow an unauthenticated user to perform code execution by sending the
maliciously crafted input to the readValue method of the ObjectMapper.
(CVE-2017-7525)
Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting
CVE-2017-7525.
4. Solution:
Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability
1459158 - CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
6. Package List:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 5 Server:
Source:
apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el5.src.rpm
codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el5.src.rpm
hibernate4-eap6-4.2.27-1.Final_redhat_1.1.ep6.el5.src.rpm
hornetq-2.3.25-22.SP20_redhat_1.1.ep6.el5.src.rpm
infinispan-5.2.22-1.Final_redhat_1.1.ep6.el5.src.rpm
jboss-as-appclient-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-cli-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-client-all-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-clustering-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-cmp-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-connector-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-controller-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-controller-client-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-core-security-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-deployment-repository-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-deployment-scanner-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-domain-http-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-domain-management-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-ee-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-ee-deployment-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-ejb3-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-embedded-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-host-controller-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-jacorb-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-jaxr-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-jaxrs-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-jdr-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-jmx-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-jpa-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-jsf-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-jsr77-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-logging-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-mail-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-management-client-content-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-messaging-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-modcluster-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-naming-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-network-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-osgi-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-osgi-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-osgi-service-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-picketlink-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-platform-mbean-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-pojo-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-process-controller-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-protocol-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-remoting-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-sar-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-security-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-server-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-system-jmx-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-threads-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-transactions-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-version-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-web-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-webservices-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-weld-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-as-xts-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jboss-marshalling-1.4.10-3.SP3_redhat_1.1.ep6.el5.src.rpm
jboss-metadata-7.2.3-1.Final_redhat_1.1.ep6.el5.src.rpm
jboss-modules-1.3.10-1.Final_redhat_1.1.ep6.el5.src.rpm
jboss-remoting3-3.3.10-1.Final_redhat_1.1.ep6.el5.src.rpm
jboss-vfs2-3.2.12-1.Final_redhat_1.1.ep6.el5.src.rpm
jbossas-appclient-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jbossas-bundles-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jbossas-core-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jbossas-domain-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jbossas-javadocs-7.5.17-4.Final_redhat_4.1.ep6.el5.src.rpm
jbossas-modules-eap-7.5.17-1.Final_redhat_4.1.ep6.el5.src.rpm
jbossas-product-eap-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jbossas-standalone-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jbossas-welcome-content-eap-7.5.17-2.Final_redhat_4.1.ep6.el5.src.rpm
jbossweb-7.5.24-1.Final_redhat_1.1.ep6.el5.src.rpm
log4j-eap6-1.2.16-12.redhat_3.1.ep6.el5.src.rpm
log4j-jboss-logmanager-1.1.4-1.Final_redhat_1.1.ep6.el5.src.rpm
picketlink-bindings-2.5.4-17.SP15_redhat_1.1.ep6.el5.src.rpm
picketlink-federation-2.5.4-17.SP15_redhat_1.1.ep6.el5.src.rpm
noarch:
apache-cxf-2.7.18-7.SP6_redhat_1.1.ep6.el5.noarch.rpm
codehaus-jackson-1.9.9-11.redhat_5.1.ep6.el5.noarch.rpm
codehaus-jackson-core-asl-1.9.9-11.redhat_5.1.ep6.el5.noarch.rpm
codehaus-jackson-jaxrs-1.9.9-11.redhat_5.1.ep6.el5.noarch.rpm
codehaus-jackson-mapper-asl-1.9.9-11.redhat_5.1.ep6.el5.noarch.rpm
codehaus-jackson-xc-1.9.9-11.redhat_5.1.ep6.el5.noarch.rpm
hibernate4-core-eap6-4.2.27-1.Final_redhat_1.1.ep6.el5.noarch.rpm
hibernate4-eap6-4.2.27-1.Final_redhat_1.1.ep6.el5.noarch.rpm
hibernate4-entitymanager-eap6-4.2.27-1.Final_redhat_1.1.ep6.el5.noarch.rpm
hibernate4-envers-eap6-4.2.27-1.Final_redhat_1.1.ep6.el5.noarch.rpm
hibernate4-infinispan-eap6-4.2.27-1.Final_redhat_1.1.ep6.el5.noarch.rpm
hornetq-2.3.25-22.SP20_redhat_1.1.ep6.el5.noarch.rpm
infinispan-5.2.22-1.Final_redhat_1.1.ep6.el5.noarch.rpm
infinispan-cachestore-jdbc-5.2.22-1.Final_redhat_1.1.ep6.el5.noarch.rpm
infinispan-cachestore-remote-5.2.22-1.Final_redhat_1.1.ep6.el5.noarch.rpm
infinispan-client-hotrod-5.2.22-1.Final_redhat_1.1.ep6.el5.noarch.rpm
infinispan-core-5.2.22-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jboss-as-appclient-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-cli-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-client-all-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-clustering-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-cmp-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-connector-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-controller-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-controller-client-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-core-security-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-deployment-repository-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-deployment-scanner-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-domain-http-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-domain-management-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-ee-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-ee-deployment-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-ejb3-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-embedded-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-host-controller-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-jacorb-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-jaxr-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-jaxrs-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-jdr-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-jmx-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-jpa-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-jsf-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-jsr77-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-logging-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-mail-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-management-client-content-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-messaging-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-modcluster-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-naming-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-network-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-osgi-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-osgi-configadmin-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-osgi-service-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-picketlink-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-platform-mbean-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-pojo-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-process-controller-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-protocol-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-remoting-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-sar-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-security-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-server-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-system-jmx-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-threads-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-transactions-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-version-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-web-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-webservices-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-weld-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-as-xts-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jboss-marshalling-1.4.10-3.SP3_redhat_1.1.ep6.el5.noarch.rpm
jboss-metadata-7.2.3-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jboss-metadata-appclient-7.2.3-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jboss-metadata-common-7.2.3-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jboss-metadata-ear-7.2.3-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jboss-metadata-ejb-7.2.3-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jboss-metadata-web-7.2.3-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jboss-modules-1.3.10-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jboss-remoting3-3.3.10-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jboss-vfs2-3.2.12-1.Final_redhat_1.1.ep6.el5.noarch.rpm
jbossas-appclient-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jbossas-bundles-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jbossas-core-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jbossas-domain-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jbossas-javadocs-7.5.17-4.Final_redhat_4.1.ep6.el5.noarch.rpm
jbossas-modules-eap-7.5.17-1.Final_redhat_4.1.ep6.el5.noarch.rpm
jbossas-product-eap-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jbossas-standalone-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jbossas-welcome-content-eap-7.5.17-2.Final_redhat_4.1.ep6.el5.noarch.rpm
jbossweb-7.5.24-1.Final_redhat_1.1.ep6.el5.noarch.rpm
log4j-eap6-1.2.16-12.redhat_3.1.ep6.el5.noarch.rpm
log4j-jboss-logmanager-1.1.4-1.Final_redhat_1.1.ep6.el5.noarch.rpm
picketlink-bindings-2.5.4-17.SP15_redhat_1.1.ep6.el5.noarch.rpm
picketlink-federation-2.5.4-17.SP15_redhat_1.1.ep6.el5.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2017-5645
https://access.redhat.com/security/cve/CVE-2017-5664
https://access.redhat.com/security/cve/CVE-2017-7525
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform?version=6.4/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFZrr9RXlSAg2UNWIIRAv9fAJ4nf1J5d/Un53zvfjY6U2NsZzQENwCgqVUG
z3PZF72JIMAuDwRIAurzggo=
=w1Ep
- -----END PGP SIGNATURE-----
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
=====================================================================
Red Hat Security Advisory
Synopsis: Important: jboss-ec2-eap security, bug fix, and enhancement update
Advisory ID: RHSA-2017:2638-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2017:2638
Issue date: 2017-09-05
CVE Names: CVE-2017-5645 CVE-2017-5664 CVE-2017-7525
=====================================================================
1. Summary:
An update for jboss-ec2-eap is now available for Red Hat JBoss Enterprise
Application Platform 6.4 for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server - noarch
3. Description:
The jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise
Application Platform running on the Amazon Web Services (AWS) Elastic
Compute Cloud (EC2).
With this update, the jboss-ec2-eap package has been updated to ensure
compatibility with Red Hat JBoss Enterprise Application Platform 6.4.17.
Security Fix(es):
* It was found that when using remote logging with log4j socket server the
log4j server would deserialize any log event received via TCP or UDP. An
attacker could use this flaw to send a specially crafted log event that,
during deserialization, would execute arbitrary code in the context of the
logger application. (CVE-2017-5645)
* A vulnerability was discovered in the error page mechanism in Tomcat's
DefaultServlet implementation. A crafted HTTP request could cause undesired
side effects, possibly including the removal or replacement of the custom
error page. (CVE-2017-5664)
* A deserialization flaw was discovered in the jackson-databind which could
allow an unauthenticated user to perform code execution by sending the
maliciously crafted input to the readValue method of the ObjectMapper.
(CVE-2017-7525)
Red Hat would like to thank Liao Xinxi (NSFOCUS) for reporting
CVE-2017-7525.
4. Solution:
Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability
1459158 - CVE-2017-5664 tomcat: Security constrained bypass in error page mechanism
1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
6. Package List:
Red Hat JBoss Enterprise Application Platform 6.4 for RHEL 6 Server:
Source:
jboss-ec2-eap-7.5.17-1.Final_redhat_4.ep6.el6.src.rpm
noarch:
jboss-ec2-eap-7.5.17-1.Final_redhat_4.ep6.el6.noarch.rpm
jboss-ec2-eap-samples-7.5.17-1.Final_redhat_4.ep6.el6.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2017-5645
https://access.redhat.com/security/cve/CVE-2017-5664
https://access.redhat.com/security/cve/CVE-2017-7525
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en/red-hat-jboss-enterprise-application-platform?version=6.4/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2017 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iD8DBQFZrsTuXlSAg2UNWIIRAgrcAJ46V5WIrgEDi76hapx8xzMmXZPwEQCgjWY0
af7+dWn/JF3BmZRr3vCFGJM=
=+HDV
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
http://www.auscert.org.au/render.html?cid=1980
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBWa8zRIx+lLeg9Ub1AQhIEg/+Myqd34+CflkNb7+8N/2K7URYi8lZBEkn
GMRbV7Npo8LKF0UTQRBSXZkeCkdT1LPP6XglTHid6b+XeQIaWObD5ghNHxtfnh/4
P4Eo+Mru+EWoHUkphb3hV4d9zm+BuCW5a5f3R1DnM7RACUl6IowxWp3RKK19lLj/
XqQNDpr28Sb78E+ura9RTBR274bfiVf6s9QOcVBXOdvFP7aZLMiU50nUp0nCppJ5
y8qWMUIFsbL5RxPcSCPc2qhcI7KS0Npa/Pr+tNMH92jlJZDOkPXcjQfH+GW+kelw
dYVxgCWuHA7OkfalM8rO4PC/xJBW9YdF1DgLKM2qmJTh4c9aj3J90N3ioOeimfGm
KoCWzwIS/z4jv7z6b9Row+tCFCHU4C0Z/tXLVC1KkJgF0kjHi47v5x/SXZJPNbA/
Y2c5T3h2t20T2LwGWHiU5Uo1vYj6HVKxkra6PtOfTB0g7XqjeT1U18x6rF5rqsHD
O3y9kTuKtbWD0yhfS9WefysT15htCmEGinsol+ia4TyQKhO40xG2tHMAqT5WT3TF
/3aL+ggFrmOkpk6W8YlQptZN9DqI3558bJJITL38tFe83mHwjkQ2YiDo+a/m3K2f
Ie5EmYyF0ApvRzCmwrAqWBz/BSxnY5J4oFjUqfdIxCvWpoB+3+/mseBHwyGqHPuT
mAsSoUD8Vek=
=L7Oe
-----END PGP SIGNATURE-----