Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.1864 Moderate: Red Hat JBoss Fuse/A-MQ 6.3 R8 security and bug fix update 27 June 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: Red Hat JBoss Fuse/A-MQ Publisher: Red Hat Operating System: Red Hat UNIX variants (UNIX, Linux, OSX) Windows Impact/Access: Access Confidential Data -- Remote/Unauthenticated Resolution: Patch/Upgrade CVE Names: CVE-2018-9159 Original Bulletin: https://access.redhat.com/errata/RHSA-2018:2020 Comment: This advisory references vulnerabilities in products which run on platforms other than Red Hat. It is recommended that administrators running Red Hat JBoss Fuse/A-MQ check for an updated version of the software for their operating system. - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat JBoss Fuse/A-MQ 6.3 R8 security and bug fix update Advisory ID: RHSA-2018:2020-01 Product: Red Hat JBoss Fuse Advisory URL: https://access.redhat.com/errata/RHSA-2018:2020 Issue date: 2018-06-26 CVE Names: CVE-2018-9159 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss Fuse and Red Hat JBoss A-MQ. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Fuse, based on Apache ServiceMix, provides a small-footprint, flexible, open source enterprise service bus and integration platform. Red Hat JBoss A-MQ, based on Apache ActiveMQ, is a standards compliant messaging system that is tailored for use in mission critical applications. This patch is an update to Red Hat JBoss Fuse 6.3 and Red Hat JBoss A-MQ 6.3. It includes bug fixes and enhancements, which are documented in the readme.txt file included with the patch files. Security Fix(es): * spark: Absolute and relative pathnames allow for unintended static file disclosure (CVE-2018-9159) 3. Solution: Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on. Installation instructions are located in the download section of the customer portal. The References section of this erratum contains a download link (you must log in to download the update). 4. Bugs fixed (https://bugzilla.redhat.com/): 1563732 - CVE-2018-9159 spark: Absolute and relative pathnames allow for unintended static file disclosure 5. References: https://access.redhat.com/security/cve/CVE-2018-9159 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=securityPatches&version=6.3 https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=securityPatches&product=jboss.amq.broker&version=6.3.0 https://access.redhat.com/documentation/en-us/red_hat_amq/6.3/ https://access.redhat.com/documentation/en-us/red_hat_fuse/6.3/ 6. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBWzJsotzjgjWX9erEAQjJGQ//ToQYr/Mve7FE/UbTSSgrTzYg4CzRtau5 BYONy1MAf31DPl/VIlpDgkR19c26AGwGJzkCp50lbra5A3WEgg+WH3LRURjxhMLo dDC538Tnu7eDV8H/DsnFpVlTL2La3sN/z7DwmUjvQzHEqXhFOEWWgNAS2I1S2MZv XkCGnD41Hj/AX8dRJ5Lkc3iagzVoLfYetJct42Bu00BL/p1l7+B6vhwuzOEQOqXE 2REqWKcRCfjVHDy6UfQUeXx41OByiGZhLt1AVtpWqrzpAfYIAZbeQyr2N8KrpdKM tPeIt5BFTmMm1aSthe00RMLrJlh3nIoCTFtB/0EXg4PZcQ9pVXqcc1mDFK4Au062 Kxe9b7VfiblwAyqKVx49ZZ6SiE7jmfqUncFWRG/K4GhHbrwJ+h3itU5JaJOGXUeA 6wir9gmCI/77C+bQ5GaLRL2rdaKrW2V+uo7p4KuuPaBNtdQBQLg020AU5Z3J6/5O nkbWPnwgQTSy+IB+bOnmuxCbuQJRyE7Wr0skE5WpFfdHTU0kDK1Sv29u7vOFCrLq JOw4fulPjb89s0awnUbTzaadO3s61Afm8Z5wYI6m4Ry5CJdbMn4k5XLOpttNAupV JcRiDSR9HM2ygjHCwkXGVJ3No7zjC9ubX5TJrhgWx+srrTpWn7HVkpv4Ygt/PXrb Z0EmE5XoGLA= =VIJW - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBWzLbXWaOgq3Tt24GAQggxxAAmp5nQYpWeqmj/e90SpzgQRdL1KhT0pVA VaaXBshkchvvNWkDhpgODqTSDbBmS1nHONmHOKe2KkOpulFPGNYIjoPnHwXoxJ6p H9daayopGtvjLh9tMdY+CwTKKmIZUnPL/aUAc094Ua0tUW7LpZ/PzfBTMdWLLnPM GfJnqED/VpOGNyj57qehP6n+rgiwkr1R1w8TVf5DPIMuFnj7YkqkYgppKTugkDa+ 0uJJSOg3vBxHIhB7FVslvxDtusWyA+h9mUfDFeipozfJrXSWgvjD8jcZj2iLncDv 2Yycn7iZgYmNT/mHb/uTe0opu8b8lCOj1fGScIvO0Y1SYwX++EXB0ocs42f83hrK cxGxL0zpsbuXn+jWU9chUPI8YhGv7kPznA/tmYKLp6zGlzeMYvRzxpZ5D9KmZgKr C5gT7GNhB3zEaF1/GUnvN+/HD9YSEDf5d3C1mRGti69IGzcTKhgA/n/7u9waJcw3 SB1DV52busivXr/xZENXIKbVDUS1WYBT4RbjCfEjHpmf0lKKqcihpsZIxopL+jyw GvHhMkUhWToj/W36iNqaUyMoci4CD19fkUinoFmdBAP4fjQp55wweQd/d99m0cty xbiSdZCBvyUVZxTDPlnEFjOCciGiprcvz+QI0NhVmWjs7w3vXBfDLO3xGjgwoGbn 7CgPUGpk7TI= =/a0P -----END PGP SIGNATURE-----