RHSA-2018:0628: Important: Red Hat JBoss Enterprise Application Platform 7.1 security update
Red Hat JBoss Enterprise Application Platform is a platform for Java applications based on WildFly.<br>This asynchronous patch is a security update for slf4j package in Red Hat JBoss Enterprise Application Platform 7.1.<br>Security Fix(es):<br><li> An XML deserialization vulnerability was discovered in slf4j's EventData which accepts xml serialized string and can lead to arbitrary code execution. (CVE-2018-8088)</li> The Simple Logging Facade for Java or (SLF4J) is a simple facade for various<br>logging APIs allowing the end-user to plug in the desired implementation at<br>deployment time. SLF4J also allows for a gradual migration path away from<br>Jakarta Commons Logging (JCL).<br>Red Hat would like to thank Chris McCown for reporting CVE-2018-8088.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2018:0628?
The severity of RHSA-2018:0628 is classified as critical due to the XML deserialization vulnerability.
How do I fix RHSA-2018:0628?
To fix RHSA-2018:0628, update the affected packages to version 1.7.22-3.redhat_2.1.ep7.el7.
What software is affected by RHSA-2018:0628?
RHSA-2018:0628 affects several packages including eap7-slf4j and eap7-jcl-over-slf4j in Red Hat JBoss EAP.
What vulnerability does RHSA-2018:0628 address?
RHSA-2018:0628 addresses an XML deserialization vulnerability that could be exploited by an attacker.
Is RHSA-2018:0628 applicable to multiple systems?
Yes, RHSA-2018:0628 is applicable to multiple systems, particularly those running different versions of Red Hat JBoss EAP.