Security Advisory Important: JBoss Enterprise Application Platform 7.0.2 on RHEL 6

Advisory: RHSA-2016:1838-1
Type: Security Advisory
Severity: Important
Issued on: 2016-09-08
Last updated on: 2016-09-08
Affected Products:
CVEs (cve.mitre.org): CVE-2015-0254
CVE-2016-4993
CVE-2016-5406

Details

Updated packages that provide Red Hat JBoss Enterprise Application Platform
7.0.2, fix several bugs, and add various enhancements are now available for Red
Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

Red Hat JBoss Enterprise Application Platform 7 is an application server that
serves as a middleware platform and is built on open standards and compliant
with the Java EE 7 specification.

This release serves as a replacement for Red Hat JBoss Enterprise Application
Platform 7.0.1. It includes bug fixes and enhancements. Refer to the JBoss
Enterprise Application Platform 7.0.2 Release Notes linked to in the References
section for information about the most significant bug fixes and enhancements
included in this release.

Security Fix(es):

* It was found that the Java Standard Tag Library (JSTL) allowed the processing
of untrusted XML documents to utilize external entity references, which could
access resources on the host system and, potentially, allowing arbitrary code
execution. (CVE-2015-0254)

* It was reported that EAP 7 Application Server/Undertow web server is
vulnerable to the injection of arbitrary HTTP headers, and also response
splitting, due to insufficient sanitization and validation of user input before
the input is used as part of an HTTP header value. (CVE-2016-4993)

* The domain controller will not propagate its administrative RBAC configuration
to some slaves. An attacker could use this to escalate their privileges.
(CVE-2016-5406)

Red Hat would like to thank Calum Hutton (NCC Group) and Mikhail Egorov (Odin)
for reporting CVE-2016-4993. The CVE-2016-5406 issue was discovered by Tomaz
Cerar (Red Hat).


Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in
this advisory, refer to:

https://access.redhat.com/articles/11258

The JBoss server process must be restarted for the update to take effect.

Updated packages

(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

1198606 - CVE-2015-0254 jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags
1359014 - CVE-2016-5406 EAP7 Privilege escalation when managing domain including earlier version slaves


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/