{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "A security update is now available for Red Hat JBoss Enterprise Application Platform from the Customer Portal.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on Wildfly.\n\nThis asynchronous patch is a security update for wildfly-core and apache-cxf packages in Red Hat JBoss Enterprise Application Platform 7.1 \n\nSecurity Fix(es):\n\n* apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)\n\n* wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files. (CVE-2018-10862)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2018:2276", "url": "https://access.redhat.com/errata/RHSA-2018:2276" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "1593527", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1593527" }, { "category": "external", "summary": "1595332", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595332" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_2276.json" } ], "title": "Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1 security update", "tracking": { "current_release_date": "2026-06-28T12:21:39+00:00", "generator": { "date": "2026-06-28T12:21:39+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.2.6" } }, "id": "RHSA-2018:2276", "initial_release_date": "2018-07-26T15:49:17+00:00", "revision_history": [ { "date": "2018-07-26T15:49:17+00:00", "number": "1", "summary": "Initial version" }, { "date": "2018-07-26T15:49:17+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-06-28T12:21:39+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product": { "name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7.1::el7" } } }, { "category": "product_name", "name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product": { "name": "Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1", "product_identification_helper": { "cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:7::el6" } } } ], "category": "product_family", "name": "Red Hat JBoss Enterprise Application Platform" }, { "branches": [ { "category": "product_version", "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src", "product": { "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src", "product_id": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-cxf@3.1.16-1.redhat_1.1.ep7.el7?arch=src" } } }, { "category": "product_version", "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src", "product": { "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src", "product_id": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-xml-security@2.0.10-1.redhat_1.1.ep7.el7?arch=src" } } }, { "category": "product_version", "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src", "product": { "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src", "product_id": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j@2.1.12-1.redhat_1.1.ep7.el7?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src", "product": { "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src", "product_id": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.1.3-4.GA_redhat_3.1.ep7.el7?arch=src" } } }, { "category": "product_version", "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src", "product": { "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src", "product_id": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-cxf@3.1.16-1.redhat_1.1.ep7.el6?arch=src" } } }, { "category": "product_version", "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src", "product": { "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src", "product_id": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-xml-security@2.0.10-1.redhat_1.1.ep7.el6?arch=src" } } }, { "category": "product_version", "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src", "product": { "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src", "product_id": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j@2.1.12-1.redhat_1.1.ep7.el6?arch=src" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src", "product": { "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src", "product_id": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.1.3-4.GA_redhat_3.1.ep7.el6?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-cxf@3.1.16-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-cxf-tools@3.1.16-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-cxf-rt@3.1.16-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-cxf-services@3.1.16-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-xml-security@2.0.10-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-ws-security-common@2.1.12-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-policy@2.1.12-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-ws-security-stax@2.1.12-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j@2.1.12-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-ws-security-dom@2.1.12-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-bindings@2.1.12-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product": { "name": "eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_id": "eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-ws-security-policy-stax@2.1.12-1.redhat_1.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "product": { "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "product_id": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.1.3-4.GA_redhat_3.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "product": { "name": "eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "product_id": "eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.1.3-4.GA_redhat_3.1.ep7.el7?arch=noarch" } } }, { "category": "product_version", "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-cxf@3.1.16-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-cxf-rt@3.1.16-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-cxf-tools@3.1.16-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-apache-cxf-services@3.1.16-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-xml-security@2.0.10-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-ws-security-common@2.1.12-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-policy@2.1.12-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-ws-security-stax@2.1.12-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j@2.1.12-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-bindings@2.1.12-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-ws-security-dom@2.1.12-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product": { "name": "eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_id": "eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wss4j-ws-security-policy-stax@2.1.12-1.redhat_1.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "product": { "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "product_id": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly@7.1.3-4.GA_redhat_3.1.ep7.el6?arch=noarch" } } }, { "category": "product_version", "name": "eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "product": { "name": "eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "product_id": "eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/eap7-wildfly-modules@7.1.3-4.GA_redhat_3.1.ep7.el6?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src" }, "product_reference": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch" }, "product_reference": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src" }, "product_reference": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch" }, "product_reference": "eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src" }, "product_reference": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch" }, "product_reference": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 6 Server", "product_id": "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src" }, "product_reference": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src", "relates_to_product_reference": "6Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src" }, "product_reference": "eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch" }, "product_reference": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src" }, "product_reference": "eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch" }, "product_reference": "eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src" }, "product_reference": "eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch" }, "product_reference": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch", "relates_to_product_reference": "7Server-JBEAP-7.1" }, { "category": "default_component_of", "full_product_name": { "name": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src as a component of Red Hat JBoss Enterprise Application Platform 7.1 for RHEL 7 Server", "product_id": "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src" }, "product_reference": "eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src", "relates_to_product_reference": "7Server-JBEAP-7.1" } ] }, "vulnerabilities": [ { "cve": "CVE-2018-8039", "cwe": { "id": "CWE-248", "name": "Uncaught Exception" }, "discovery_date": "2018-06-26T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1595332" } ], "notes": [ { "category": "description", "text": "It was discovered that when Apache CXF is configured to use the system property com.sun.net.ssl.internal.www.protocol ,it uses reflection to make the HostnameVerifier work with old com.sun.net.ssl.HostnameVerifier interface. Although the CXF implementation throws an exception, which is caught in the reflection code but it is not properly propagated, this can lead to a man-in-the-middle attack.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*", "title": "Vulnerability summary" }, { "category": "other", "text": "In OpenShift Logging the openshift-logging/elasticsearch6-rhel8 container bundles the vulnerable version of apache-cxf, but the vulnerable class is not shipped, hence this component is not affected by this vulnerability.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-8039" }, { "category": "external", "summary": "RHBZ#1595332", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1595332" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-8039", "url": "https://www.cve.org/CVERecord?id=CVE-2018-8039" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-8039", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8039" }, { "category": "external", "summary": "http://cxf.apache.org/security-advisories.data/CVE-2018-8039.txt.asc?version=1&modificationDate=1530184663000&api=v2", "url": "http://cxf.apache.org/security-advisories.data/CVE-2018-8039.txt.asc?version=1&modificationDate=1530184663000&api=v2" } ], "release_date": "2018-06-29T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-07-26T15:49:17+00:00", "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe JBoss server process must be restarted for the update to take effect.\n\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:2276" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "version": "3.0" }, "products": [ "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.*" }, { "cve": "CVE-2018-10862", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2018-06-21T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1593527" } ], "notes": [ { "category": "description", "text": "It was found that the explode function of the deployment utility in jboss-cli and console that allows extraction of files from an archive does not perform necessary validation for directory traversal. This can lead to remote code execution.", "title": "Vulnerability description" }, { "category": "summary", "text": "wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)", "title": "Vulnerability summary" }, { "category": "other", "text": "This vulnerability can only be exploited by users with deployment permissions.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2018-10862" }, { "category": "external", "summary": "RHBZ#1593527", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1593527" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2018-10862", "url": "https://www.cve.org/CVERecord?id=CVE-2018-10862" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2018-10862", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-10862" }, { "category": "external", "summary": "https://snyk.io/research/zip-slip-vulnerability", "url": "https://snyk.io/research/zip-slip-vulnerability" } ], "release_date": "2018-06-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2018-07-26T15:49:17+00:00", "details": "Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.\n\nThe JBoss server process must be restarted for the update to take effect.\n\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2018:2276" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L", "version": "3.0" }, "products": [ "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el6.src", "6Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.noarch", "6Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el6.src", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-0:3.1.16-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-apache-cxf-rt-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-services-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-apache-cxf-tools-0:3.1.16-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wildfly-0:7.1.3-4.GA_redhat_3.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wildfly-modules-0:7.1.3-4.GA_redhat_3.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-0:2.1.12-1.redhat_1.1.ep7.el7.src", "7Server-JBEAP-7.1:eap7-wss4j-bindings-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-policy-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-common-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-dom-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-policy-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-wss4j-ws-security-stax-0:2.1.12-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.noarch", "7Server-JBEAP-7.1:eap7-xml-security-0:2.0.10-1.redhat_1.1.ep7.el7.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)" } ] }