RHSA-2018:0627: Important: Red Hat JBoss Enterprise Application Platform 6.4 security update
Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on the JBoss Application Server.<br>This asynchronous patch is a security update for slf4j package in Red Hat JBoss Enterprise Application Platform 6.4.<br>Security Fix(es):<br><li> An XML deserialization vulnerability was discovered in slf4j's EventData which accepts xml serialized string and can lead to arbitrary code execution. (CVE-2018-8088)</li> The Simple Logging Facade for Java or (SLF4J) is a simple facade for various logging APIs allowing the end-user to plug in the desired implementation at deployment time. SLF4J also allows for a gradual migration path away from Jakarta Commons Logging (JCL).<br>Red Hat would like to thank Chris McCown for reporting CVE-2018-8088.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2018:0627?
RHSA-2018:0627 is classified as an important security update.
How do I fix RHSA-2018:0627?
To fix RHSA-2018:0627, update the slf4j package to version 1.7.2-14.redhat_4.1.ep6.el7 or later.
What software is affected by RHSA-2018:0627?
RHSA-2018:0627 affects multiple versions of the slf4j package in Red Hat JBoss Enterprise Application Platform 6.4.
What type of vulnerability is addressed in RHSA-2018:0627?
RHSA-2018:0627 addresses an XML deserialization vulnerability.
Is there a workaround for RHSA-2018:0627?
There are no documented workarounds for RHSA-2018:0627 and users are advised to apply the necessary updates.