RedHat: RHSA-2018-2669:01 Important: Fuse 7.1 security update
Summary
Red Hat Fuse, based on Apache ServiceMix, provides a small-footprint,
flexible, open source enterprise service bus and integration platform.
This release of Red Hat Fuse 7.1 serves as a replacement for Red Hat Fuse
7.0, and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* Apache Struts 1: Class Loader manipulation via request parameters(CVE-2014-0114)
* thrift: Improper file path sanitization in
t_go_generator.cc:format_go_output() of the go client library can allow an
attacker to inject commands (CVE-2016-5397)
* slf4j: Deserialisation vulnerability in EventData constructor can allow
for arbitrary code execution (CVE-2018-8088)
* jolokia: JMX proxy mode vulnerable to remote code execution
(CVE-2018-1000130)
* bouncycastle: DSA does not fully validate ASN.1 encoding during signature
verification allowing for injection of unsigned data (CVE-2016-1000338)
* bouncycastle: Information leak in AESFastEngine class (CVE-2016-1000339)
* bouncycastle: Information exposure in DSA signature generation via timing
attack (CVE-2016-1000341)
* bouncycastle: ECDSA improper validation of ASN.1 encoding of signature
(CVE-2016-1000342)
* bouncycastle: DHIES implementation allowed the use of ECB mode
(CVE-2016-1000344)
* bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle
attack (CVE-2016-1000345)
* bouncycastle: Other party DH public keys are not fully validated
(CVE-2016-1000346)
* bouncycastle: ECIES implementation allowed the use of ECB mode
(CVE-2016-1000352)
* async-http-client: Invalid URL parsing with '?' (CVE-2017-14063)
* undertow: File descriptor leak caused by
JarURLConnection.getLastModified() allows attacker to cause a denial of
service (CVE-2018-1114)
* spring-framework: Directory traversal vulnerability with static resources
on Windows filesystems (CVE-2018-1271)
* tika: Infinite loop in BPGParser can allow remote attacker to cause a
denial of service (CVE-2018-1338)
* tika: Infinite loop in ChmParser can allow remote attacker to cause a
denial of service (CVE-2018-1339)
* pdfbox: Infinite loop in AFMParser.java allows for out of memory erros
via crafted PDF (CVE-2018-8036)
* jolokia: Cross site scripting in the HTTP servlet (CVE-2018-1000129)
* bouncycastle: flaw in the low-level interface to RSA key pair generator
(CVE-2018-1000180)
* bouncycastle: Carry propagation bug in math.raw.Nat??? class
(CVE-2016-1000340)
* bouncycastle: DSA key pair generator generates a weak private key by
default (CVE-2016-1000343)
* spring-framework: Multipart content pollution (CVE-2018-1272)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Red Hat would like to thank Chris McCown for reporting CVE-2018-8088.
Summary
Solution
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
Installation instructions are located in the download section of the
customer portal.
The References section of this erratum contains a download link (you must
log in to download the update).
References
https://access.redhat.com/security/cve/CVE-2014-0114 https://access.redhat.com/security/cve/CVE-2016-5397 https://access.redhat.com/security/cve/CVE-2016-1000338 https://access.redhat.com/security/cve/CVE-2016-1000339 https://access.redhat.com/security/cve/CVE-2016-1000340 https://access.redhat.com/security/cve/CVE-2016-1000341 https://access.redhat.com/security/cve/CVE-2016-1000342 https://access.redhat.com/security/cve/CVE-2016-1000343 https://access.redhat.com/security/cve/CVE-2016-1000344 https://access.redhat.com/security/cve/CVE-2016-1000345 https://access.redhat.com/security/cve/CVE-2016-1000346 https://access.redhat.com/security/cve/CVE-2016-1000352 https://access.redhat.com/security/cve/CVE-2017-14063 https://access.redhat.com/security/cve/CVE-2018-1114 https://access.redhat.com/security/cve/CVE-2018-1271 https://access.redhat.com/security/cve/CVE-2018-1272 https://access.redhat.com/security/cve/CVE-2018-1338 https://access.redhat.com/security/cve/CVE-2018-1339 https://access.redhat.com/security/cve/CVE-2018-8036 https://access.redhat.com/security/cve/CVE-2018-8088 https://access.redhat.com/security/cve/CVE-2018-1000129 https://access.redhat.com/security/cve/CVE-2018-1000130 https://access.redhat.com/security/cve/CVE-2018-1000180 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse&downloadType=distributions&version=7.1.0 https://access.redhat.com/documentation/en-us/red_hat_fuse/7.1/ https://access.redhat.com/articles/2939351
Package List
Topic
An update is now available for Red Hat Fuse.Red Hat Product Security has rated this update as having a security impactof Important. A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is available for each vulnerabilityfrom the CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
1091938 - CVE-2014-0114 Apache Struts 1: Class Loader manipulation via request parameters1487563 - CVE-2017-14063 async-http-client: Invalid URL parsing with '?'
1544620 - CVE-2016-5397 thrift: Improper file path sanitization in t_go_generator.cc:format_go_output() of the go client library can allow an attacker to inject commands
1548909 - CVE-2018-8088 slf4j: Deserialisation vulnerability in EventData constructor can allow for arbitrary code execution
1559316 - CVE-2018-1000130 jolokia: JMX proxy mode vulnerable to remote code execution
1559317 - CVE-2018-1000129 jolokia: Cross site scripting in the HTTP servlet
1564408 - CVE-2018-1272 spring-framework: Multipart content pollution
1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
1572421 - CVE-2018-1338 tika: Infinite loop in BPGParser can allow remote attacker to cause a denial of service
1572424 - CVE-2018-1339 tika: Infinite loop in ChmParser can allow remote attacker to cause a denial of service
1573045 - CVE-2018-1114 undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service
1588306 - CVE-2018-1000180 bouncycastle: flaw in the low-level interface to RSA key pair generator
1588313 - CVE-2016-1000338 bouncycastle: DSA does not fully validate ASN.1 encoding during signature verification allowing for injection of unsigned data
1588314 - CVE-2016-1000344 bouncycastle: DHIES implementation allowed the use of ECB mode
1588323 - CVE-2016-1000345 bouncycastle: DHIES/ECIES CBC modes are vulnerable to padding oracle attack
1588327 - CVE-2016-1000346 bouncycastle: Other party DH public keys are not fully validated
1588330 - CVE-2016-1000352 bouncycastle: ECIES implementation allowed the use of ECB mode
1588688 - CVE-2016-1000340 bouncycastle: Carry propagation bug in math.raw.Nat??? class
1588695 - CVE-2016-1000339 bouncycastle: Information leak in AESFastEngine class
1588708 - CVE-2016-1000341 bouncycastle: Information exposure in DSA signature generation via timing attack
1588715 - CVE-2016-1000342 bouncycastle: ECDSA improper validation of ASN.1 encoding of signature
1588721 - CVE-2016-1000343 bouncycastle: DSA key pair generator generates a weak private key by default
1597490 - CVE-2018-8036 pdfbox: Infinite loop in AFMParser.java allows for out of memory erros via crafted PDF