(RHSA-2018:3518) Critical: JBoss Enterprise Application Platform 5.2.0 security update

Red Hat JBoss Enterprise Application Platform is a platform for Java
applications based on the JBoss Application Server.

This asynchronous patch is a security update for the RichFaces package in Red Hat JBoss Enterprise Application Platform 5.2.

Security Fix(es):

• RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution (CVE-2018-14667)

See https://access.redhat.com/solutions/3660371 for specific information regarding this flaw.

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Joao Filho Matos Figueiredo for reporting this issue.