It is possible to configure Apache CXF to use the com.sun.net.ssl implementation via 'System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");'. When this system property is set, CXF uses some reflection to try to make the HostnameVerifier work with the old com.sun.net.ssl.HostnameVerifier interface. However, the default HostnameVerifier implementation in CXF does not implement the method in this interface, and an exception is thrown. However, in Apache CXF prior to 3.2.5 and 3.1.16 the exception is caught in the reflection code and not properly propagated. What this means is that if you are using the com.sun.net.ssl stack with CXF, an error with TLS hostname verification will not be thrown, leaving a CXF client subject to man-in-the-middle attacks.

The IBM WebSphere Application Server running on the remote host is version 9.0.x prior to 9.0.0.9. It is, therefore, affected by a man-in-the-middle (MITM) vulnerability in the Apache CXF sub-component due to the TLS hostname verification not working correctly with the com.sun.net.ssl interface. A remote, unauthenticated attacker can exploit this to launch a man-in-the-middle attack.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Oracle Enterprise Manager Cloud Control installed on the remote host is affected by multiple vulnerabilities in Enterprise Manager Base Platform component:

  - An unspecified vulnerability in the Enterprise Manager Base Platform component of   Oracle Enterprise Manager Products Suite (subcomponent: Connector Framework (Apache CXF)),   which could allow an unauthenticated, remote attacker to compromise   Enterprise Manager Base Platform. (CVE-2018-8039)

  - An unspecified vulnerability in the Oracle Enterprise Manager Base Platform component   of Oracle Enterprise Manager Products Suite (subcomponent: Valid Session (Apache ActiveMQ)),   which could allow an unauthenticated, remote attacker to compromise   Oracle Enterprise Manager Base Platform. (CVE-2019-0222)

  - An unspecified vulnerability in the Enterprise Manager Base Platform component of   Oracle Enterprise Manager Products Suite (subcomponent: Discovery Framework (OpenSSL)), which   could allow and unauthenticated, remote attacker to compromise   Enterprise Manager Base Platform. (CVE-2019-1559)

An update for rhvm-appliance is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

The RHV-M Virtual Appliance automates the process of installing and configuring the Red Hat Virtualization Manager. The appliance is available to download as an OVA file from the Customer Portal.

The following packages have been upgraded to a later upstream version:
rhvm-appliance (4.2). (BZ#1590658, BZ#1591095, BZ#1591096, BZ#1592655, BZ# 1594636, BZ#1597534, BZ#1612683)

Red Hat would like to thank the PostgreSQL project for reporting CVE-2018-10915 and Ammarit Thongthua (Deloitte Thailand Pentest team) and Nattakit Intarasorn (Deloitte Thailand Pentest team) for reporting CVE-2018-1067. Upstream acknowledges Andrew Krasichkov as the original reporter of CVE-2018-10915.

Security fixes :

* vulnerability: wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip) (CVE-2018-10862)

* vulnerability: apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)

* vulnerability: postgresql: Certain host connection parameters defeat client-side security defenses (CVE-2018-10915)

* vulnerability: undertow: HTTP header injection using CRLF with UTF-8 Encoding (incomplete fix of ) (CVE-2018-1067, CVE-2016-4993)

* vulnerability: undertow: File descriptor leak caused by JarURLConnection.getLastModified() allows attacker to cause a denial of service (CVE-2018-1114)

* vulnerability: guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote attackers to cause a denial of service (CVE-2018-10237)

* vulnerability: bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180)

For more details about the security issues, including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE pages listed in the References section.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2424 advisory.

  - cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services (CVE-2017-12624)

  - apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)

  - guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote     attackers to cause a denial of service (CVE-2018-10237)

  - wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)     (CVE-2018-10862)

  - bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2423 advisory.

  - cxf: Improper size validation in message attachment header for JAX-WS and JAX-RS services (CVE-2017-12624)

  - apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)

  - guava: Unbounded memory allocation in AtomicDoubleArray and CompoundOrdering classes allow remote     attackers to cause a denial of service (CVE-2018-10237)

  - wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)     (CVE-2018-10862)

  - bouncycastle: flaw in the low-level interface to RSA key pair generator (CVE-2018-1000180)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:2276 advisory.

  - apache-cxf: TLS hostname verification does not work correctly with com.sun.net.ssl.* (CVE-2018-8039)

  - wildfly-core: Path traversal can allow the extraction of .war archives to write arbitrary files (Zip Slip)     (CVE-2018-10862)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
141915	IBM WebSphere Application Server 9.0.x < 9.0.0.9 MITM (CVE-2018-8039)	Nessus	Web Servers	high
126775	Oracle Enterprise Manager Cloud Control (Jul 2019 CPU)	Nessus	Misc.	high
117324	RHEL 7 : Virtualization (RHSA-2018:2643)	Nessus	Red Hat Local Security Checks	high
112030	RHEL 7 : Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL7 (RHSA-2018:2424)	Nessus	Red Hat Local Security Checks	high
112029	RHEL 6 : Red Hat JBoss Enterprise Application Platform 7.1.4 on RHEL 6 (RHSA-2018:2423)	Nessus	Red Hat Local Security Checks	high
111486	RHEL 6 / 7 : Red Hat JBoss Enterprise Application Platform 7.1 (RHSA-2018:2276)	Nessus	Red Hat Local Security Checks	high

Detections

Analytics

CVE-2018-8039

high

Tenable Plugins

high

high

high

high

high

high