improper polymorphic deserialization of types from Jodd-db library
CVE: CVE-2018-12022
Component: jackson-databind
CWE: CWE-502
Severity: Important
CVSS v3: 7.3/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Release date: 2018-05-29T00:00:00+00:00

A vulnerability was discovered in jackson-databind where it would permit deserialization of a malicious object using Jodd DB connection classes when using DefaultTyping. An attacker could use this flaw to achieve remote code execution under certain circumstances.

Statement: Red Hat Satellite 6 is not affected by this issue, since Candlepin's java runtime environment does not load Jodd classes.

Red Hat Virtualization 4 is not affected by this issue, since it does not load Jodd classes.

Remediation:
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258
See the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:

https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.html
For OpenShift Container Platform 4.1 see the following documentation, which
will be updated shortly for release 4.1.18, for important instructions on
how to upgrade your cluster and fully apply this asynchronous errata
update:

https://docs.openshift.com/container-platform/4.1/release_notes/ocp-4-1-release-notes.html
To install this update, do the following:

1. Download the Data Grid 7.3.2 server patch from the customer portal.
2. Back up your existing Data Grid installation. You should back up databases, configuration files, and so on.
3. Install the Data Grid 7.3.2 server patch. Refer to the 7.3 Release Notes for patching instructions.
4. Restart Data Grid to ensure the changes take effect.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are located in the download section of the customer portal.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Installation instructions are available from the Fuse 7.5.0 product documentation page:
https://access.redhat.com/documentation/en-us/red_hat_fuse/7.5/
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

Updating instructions and release notes may be found at:

https://access.redhat.com/articles/3060411
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
For on-premise installations, before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

It is recommended to halt the server by stopping the JBoss Application Server process before installing this update; after installing the update, restart the server by starting the JBoss Application Server process.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must log in to download the update).

The JBoss server process must be restarted for the update to take effect.
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).
Before applying the update, back up your existing installation, including all applications, configuration files, databases and database settings, and so on.

The References section of this erratum contains a download link (you must log in to download the update).