RedHat: RHSA-2018-2939:01 Critical: Red Hat FIS 2.0 on Fuse 6.3.0 R8
Summary
Red Hat Fuse Integration Services provides a set of tools and containerized
xPaaS images that enable development, deployment, and management of
integration microservices within OpenShift.
Security fix(es):
* jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe
serialization via c3p0 libraries (CVE-2018-7489)
* spring-framework: Address partial fix for CVE-2018-1270 (CVE-2018-1275)
* spring-framework: Directory traversal vulnerability with static resources
on Windows filesystems (CVE-2018-1271)
* spring-framework: Possible RCE via spring messaging (CVE-2018-1270)
* spring-security-oauth: remote code execution in the authorization process
(CVE-2018-1260)
* tomcat: A bug in the UTF-8 decoder can lead to DoS (CVE-2018-1336)
* tomcat: Incorrect handling of empty string URL in security constraints
can lead to unintended exposure of resources (CVE-2018-1304)
* tomcat: Late application of security constraints can lead to resource
exposure for unauthorised users (CVE-2018-1305)
* tomcat: Remote Code Execution bypass for CVE-2017-12615 (CVE-2017-12617)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
Summary
Solution
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
Updating instructions and release notes may be found at:
https://access.redhat.com/articles/3060411
References
https://access.redhat.com/security/cve/CVE-2017-12617 https://access.redhat.com/security/cve/CVE-2018-1260 https://access.redhat.com/security/cve/CVE-2018-1270 https://access.redhat.com/security/cve/CVE-2018-1271 https://access.redhat.com/security/cve/CVE-2018-1275 https://access.redhat.com/security/cve/CVE-2018-1304 https://access.redhat.com/security/cve/CVE-2018-1305 https://access.redhat.com/security/cve/CVE-2018-1336 https://access.redhat.com/security/cve/CVE-2018-7489 https://access.redhat.com/security/updates/classification/#critical
Package List
Topic
An update is now available for Red Hat Fuse Integration Services.Red Hat Product Security has rated this update as having a security impactof Critical. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.
Topic
Relevant Releases Architectures
Bugs Fixed
1494283 - CVE-2017-12617 tomcat: Remote Code Execution bypass for CVE-2017-12615
1548282 - CVE-2018-1305 tomcat: Late application of security constraints can lead to resource exposure for unauthorised users1548289 - CVE-2018-1304 tomcat: Incorrect handling of empty string URL in security constraints can lead to unintended exposure of resources
1549276 - CVE-2018-7489 jackson-databind: incomplete fix for CVE-2017-7525 permits unsafe serialization via c3p0 libraries
1564405 - CVE-2018-1270 spring-framework: Possible RCE via spring messaging
1565307 - CVE-2018-1275 spring-framework: Address partial fix for CVE-2018-1270
1571050 - CVE-2018-1271 spring-framework: Directory traversal vulnerability with static resources on Windows filesystems
1584376 - CVE-2018-1260 spring-security-oauth: remote code execution in the authorization process
1607591 - CVE-2018-1336 tomcat: A bug in the UTF-8 decoder can lead to DoS