Security Advisory Important: eap7-jboss-ec2-eap security, bug fix, and enhancement update

Advisory: RHSA-2016:1840-1
Type: Security Advisory
Severity: Important
Issued on: 2016-09-08
Last updated on: 2016-09-08
Affected Products:
CVEs (cve.mitre.org): CVE-2015-0254
CVE-2016-4993
CVE-2016-5406

Details

An update for eap7-jboss-ec2-eap is now available for Red Hat JBoss Enterprise
Application Platform 7.0 for RHEL 6 and Red Hat JBoss Enterprise Application
Platform 7.0 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact of
Important. A Common Vulnerability Scoring System (CVSS) base score, which gives
a detailed severity rating, is available for each vulnerability from the CVE
link(s) in the References section.

The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise
Application Platform running on the Amazon Web Services (AWS) Elastic Compute
Cloud (EC2).

With this update, the eap7-jboss-ec2-eap package has been updated to ensure
compatibility with Red Hat JBoss Enterprise Application Platform 7.0.2. Refer to
the JBoss Enterprise Application Platform 7.0.2 Release Notes, linked to in the
References section, for information about the most significant bug fixes and
enhancements included in this release.

Security Fix(es):

* It was found that the Java Standard Tag Library (JSTL) allowed the processing
of untrusted XML documents to utilize external entity references, which could
access resources on the host system and, potentially, allowing arbitrary code
execution. (CVE-2015-0254)

* It was reported that EAP 7 Application Server/Undertow web server is
vulnerable to the injection of arbitrary HTTP headers, and also response
splitting, due to insufficient sanitization and validation of user input before
the input is used as part of an HTTP header value. (CVE-2016-4993)

* The domain controller will not propagate its administrative RBAC configuration
to some slaves. An attacker could use this to escalate their privileges.
(CVE-2016-5406)

Red Hat would like to thank Calum Hutton (NCC Group) and Mikhail Egorov (Odin)
for reporting CVE-2016-4993. The CVE-2016-5406 issue was discovered by Tomaz
Cerar (Red Hat).


Solution

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in
this advisory, refer to:

https://access.redhat.com/articles/11258

The JBoss server process must be restarted for the update to take effect.

Updated packages

(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

1198606 - CVE-2015-0254 jakarta-taglibs-standard: XXE and RCE via XSL extension in JSTL XML tags
1359014 - CVE-2016-5406 EAP7 Privilege escalation when managing domain including earlier version slaves


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/