Red Hat JBoss EAP 6.4 Update Fixes Request Smuggling, DoS and RBAC Data Exposure

Red Hat released RHSA-2017:0247 to update JBoss Enterprise Application Platform 6 from 6.4.12 to 6.4.13, addressing HTTP request smuggling (CVE-2016-6816), log-download resource exhaustion (CVE-2016-8627), and sensitive-information disclosure through role-based access control (CVE-2016-7061). The log-download flaw could allow cross-origin GET requests to consume server resources and impair service availability, while the RBAC flaw let Monitor-role users in domain mode view sensitive socket-binding and internal network configuration at the server level.

For EAP 6.4 deployments on RHEL 6 using the EC2 package, RHSA-2017:0250 supplied jboss-ec2-eap-7.5.13-1.Final_redhat_2.ep6.el6 and included fixes for these issues plus a local privilege-escalation issue. Red Hat later clarified that CVE-2016-8656, an unsafe-file-handling flaw in JBoss initialization scripts affecting RPM installations, was incorrectly listed as resolved by RHSA-2017:0247 because that advisory covered ZIP-distributed EAP files; affected organizations should apply the applicable supported EAP and package updates after backing up installations and deployed applications.