RHEL 6:RHEL 6 上的 Red Hat JBoss Enterprise Application Platform 7.1.6 (RHSA-2019:0364)

high Nessus 插件 ID 122332

简介

远程 Red Hat 主机缺少 RHEL 6 上 Red Hat JBoss Enterprise Application Platform 7.1.6 的一个或多个安全更新。

描述

远程 Redhat Enterprise Linux 6 主机上安装的程序包受到 RHSA-2019:0364 公告中提及的多个漏洞影响。

wildfly-core:JBoss 管理控制台中的跨站脚本 (XSS (CVE-2018-10934)

- undertow:在 Undertow 可以从随机缓冲区提供数据的某些情况下的信息泄露 (CVE-2018-14642)

- dom4j:Class: Element 中的 XML 注入。Methods:addElement、addAttribute 会影响 XML 文档的完整性 (CVE-2018-1000632)

请注意,Nessus 尚未测试这些问题,而是只依据应用程序自我报告的版本号进行判断。

解决方案

依据 RHSA-2019:0364 中的指南更新 RHEL 6 上的 RHEL Red Hat JBoss Enterprise Application Platform 7.1.6 程序包。

另见

http://www.nessus.org/u?2ae1b122

http://www.nessus.org/u?7bee5f5f

http://www.nessus.org/u?92f94c8a

https://access.redhat.com/errata/RHSA-2019:0364

https://access.redhat.com/security/updates/classification/#moderate

https://bugzilla.redhat.com/show_bug.cgi?id=1615673

https://bugzilla.redhat.com/show_bug.cgi?id=1620529

https://bugzilla.redhat.com/show_bug.cgi?id=1628702

https://issues.redhat.com/browse/JBEAP-15311

https://issues.redhat.com/browse/JBEAP-15370

https://issues.redhat.com/browse/JBEAP-15373

https://issues.redhat.com/browse/JBEAP-15440

https://issues.redhat.com/browse/JBEAP-15443

https://issues.redhat.com/browse/JBEAP-15444

https://issues.redhat.com/browse/JBEAP-15461

https://issues.redhat.com/browse/JBEAP-15482

https://issues.redhat.com/browse/JBEAP-15483

https://issues.redhat.com/browse/JBEAP-15525

https://issues.redhat.com/browse/JBEAP-15528

https://issues.redhat.com/browse/JBEAP-15545

https://issues.redhat.com/browse/JBEAP-15619

https://issues.redhat.com/browse/JBEAP-15627

https://issues.redhat.com/browse/JBEAP-15747

https://issues.redhat.com/browse/JBEAP-15842

https://issues.redhat.com/browse/JBEAP-15852

https://issues.redhat.com/browse/JBEAP-15891

https://issues.redhat.com/browse/JBEAP-16015

https://issues.redhat.com/browse/JBEAP-9658

插件详情

严重性: High

ID: 122332

文件名: redhat-RHSA-2019-0364.nasl

版本: 1.8

类型: local

代理: unix

发布时间: 2019/2/20

最近更新时间: 2024/4/24

支持的传感器: Agentless Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

风险信息

VPR

风险因素: Medium

分数: 4.4

CVSS v2

风险因素: Medium

基本分数: 5

时间分数: 3.9

矢量: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS 分数来源: CVE-2018-14642

CVSS v3

风险因素: High

基本分数: 7.5

时间分数: 6.7

矢量: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

时间矢量: CVSS:3.0/E:P/RL:O/RC:C

CVSS 分数来源: CVE-2018-1000632

漏洞信息

CPE: p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-cli, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-commons, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-core-client, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-dto, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-hornetq-protocol, p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-bindings, p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-common, p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-config, p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-federation, p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-api, p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-impl, p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-idm-simple-schema, p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-impl, p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-wildfly8, p-cpe:/a:redhat:enterprise_linux:eap7-undertow, p-cpe:/a:redhat:enterprise_linux:eap7-undertow-jastow, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-common, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-elytron, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-elytron-tool, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-javadocs, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-modules, p-cpe:/a:redhat:enterprise_linux:eap7-wildfly-web-console-eap, cpe:/o:redhat:enterprise_linux:6, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-hqclient-protocol, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-jdbc-store, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-jms-client, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-jms-server, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-journal, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-native, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-ra, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-selector, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-server, p-cpe:/a:redhat:enterprise_linux:eap7-activemq-artemis-service-extensions, p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf, p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-rt, p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-services, p-cpe:/a:redhat:enterprise_linux:eap7-apache-cxf-tools, p-cpe:/a:redhat:enterprise_linux:eap7-dom4j, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-core, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-entitymanager, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-envers, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-infinispan, p-cpe:/a:redhat:enterprise_linux:eap7-hibernate-java8, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-api, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-impl, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-common-spi, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-api, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-core-impl, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-deployers-common, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-jdbc, p-cpe:/a:redhat:enterprise_linux:eap7-ironjacamar-validator, p-cpe:/a:redhat:enterprise_linux:eap7-jackson-databind, p-cpe:/a:redhat:enterprise_linux:eap7-jandex, p-cpe:/a:redhat:enterprise_linux:eap7-jberet, p-cpe:/a:redhat:enterprise_linux:eap7-jberet-core, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-ejb-client, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-el-api_3.0_spec, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-logmanager, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-modules, p-cpe:/a:redhat:enterprise_linux:eap7-jboss-security-negotiation, p-cpe:/a:redhat:enterprise_linux:eap7-jbossws-common, p-cpe:/a:redhat:enterprise_linux:eap7-narayana, p-cpe:/a:redhat:enterprise_linux:eap7-narayana-compensations, p-cpe:/a:redhat:enterprise_linux:eap7-narayana-jbosstxbridge, p-cpe:/a:redhat:enterprise_linux:eap7-narayana-jbossxts, p-cpe:/a:redhat:enterprise_linux:eap7-narayana-jts-idlj, p-cpe:/a:redhat:enterprise_linux:eap7-narayana-jts-integration, p-cpe:/a:redhat:enterprise_linux:eap7-narayana-restat-api, p-cpe:/a:redhat:enterprise_linux:eap7-narayana-restat-bridge, p-cpe:/a:redhat:enterprise_linux:eap7-narayana-restat-integration, p-cpe:/a:redhat:enterprise_linux:eap7-narayana-restat-util, p-cpe:/a:redhat:enterprise_linux:eap7-narayana-txframework, p-cpe:/a:redhat:enterprise_linux:eap7-picketlink-api

必需的 KB 项: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

易利用性: No known exploits are available

补丁发布日期: 2019/2/18

漏洞发布日期: 2018/8/20

参考资料信息

CVE: CVE-2018-1000632, CVE-2018-10934, CVE-2018-14642

CWE: 200, 79, 88

RHSA: 2019:0364