RedHat: RHSA-2018-1833:01 Important: Red Hat JBoss Data Grid 7.2.1 security
Summary
Red Hat JBoss Data Grid is a distributed in-memory data grid based on
Infinispan.
This release of Red Hat JBoss Data Grid 7.2.1 serves as a replacement for
Red Hat JBoss Data Grid 7.2.0 and includes bug fixes and enhancements. You
can find a link to the Release Notes that describe these bug fixes and
enhancements in the References section of this erratum.
Security Fix(es):
* infinispan: deserialization of data in XML and JSON transcoders(CVE-2018-1131)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Summary
Solution
Access the download location from the References section of this erratum.
You must log in to your Red Hat account to download the update.
Before applying the update, back up your existing Red Hat JBoss Data Grid
installation. You should back up databases, configuration files, and so on.
References
https://access.redhat.com/security/cve/CVE-2018-1131 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=data.grid&downloadType=distributions&version=7.2.1
Package List
Topic
An update for Red Hat JBoss Data Grid is now available.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
1576492 - CVE-2018-1131 infinispan: deserialization of data in XML and JSON transcoders