Home / mailings [RHSA-2019:0910-01] Important: Red Hat Fuse 7.3 security update
Posted on 30 April 2019
RedHat===================================================================== Red Hat Security Advisory
Synopsis: Important: Red Hat Fuse 7.3 security update
Advisory ID: RHSA-2019:0910-01
Product: Red Hat JBoss Fuse
Advisory URL: https://access.redhat.com/errata/RHSA-2019:0910
Issue date: 2019-04-30
CVE Names: CVE-2014-0112 CVE-2017-7525 CVE-2017-7657
=====================================================================
1. Summary:
A minor version update (from 7.2 to 7.3) is now available for Red Hat Fuse.
The purpose of this text-only errata is to inform you about the security
issues fixed in this release.
Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.
2. Description:
This release of Red Hat Fuse 7.3 serves as a replacement for Red Hat Fuse
7.2, and includes bug fixes and enhancements, which are documented in the
Release Notes document linked to in the References.
Security Fix(es):
* jackson-databind: A deserialization flaw was discovered in the
jackson-databind which could allow an unauthenticated user to perform code
execution by sending the maliciously crafted input to the readValue method
of the ObjectMapper. (CVE-2017-7525)
* struts2: ClassLoader manipulation via request parameters (CVE-2014-0112)
* jetty: HTTP request smuggling (CVE-2017-7657)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
3. Solution:
Before applying the update, back up your existing installation, including
all applications, configuration files, databases and database settings, and
so on.
Installation instructions are available from the Fuse 7.3.0 product
documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/
4. Bugs fixed (https://bugzilla.redhat.com/):
1091939 - CVE-2014-0112 struts2: ClassLoader manipulation via request parameters
1462702 - CVE-2017-7525 jackson-databind: Deserialization vulnerability via readValue method of ObjectMapper
1595620 - CVE-2017-7657 jetty: HTTP request smuggling
5. References:
https://access.redhat.com/security/cve/CVE-2014-0112
https://access.redhat.com/security/cve/CVE-2017-7525
https://access.redhat.com/security/cve/CVE-2017-7657
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.fuse&version=7.3.0
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.3/html-single/release_notes/
6. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
