RedHat: RHSA-2017-3400:01 Important: Red Hat JBoss Enterprise Application
Summary
Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.
This asynchronous patch is a security update for log4j package in Red Hat
JBoss Enterprise Application Platform 5.2.0.
Security Fix(es):
* It was found that when using remote logging with log4j socket server the
log4j server would deserialize any log event received via TCP or UDP. An
attacker could use this flaw to send a specially crafted log event that,
during deserialization, would execute arbitrary code in the context of the
logger application. (CVE-2017-5645)
Summary
Solution
Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.
The References section of this erratum contains a download link (you must
log in to download the update).
References
https://access.redhat.com/security/cve/CVE-2017-5645 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=5.2.0 https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/
Package List
Topic
An update is now available for Red Hat JBoss Enterprise ApplicationPlatform.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
1443635 - CVE-2017-5645 log4j: Socket receiver deserialization vulnerability