(RHSA-2018:3581) Critical: Red Hat JBoss BRMS 5.3.1 security update

Red Hat JBoss BRMS is a business rules management system for the
management, storage, creation, modification, and deployment of JBoss Rules.

This asynchronous patch is a security update for the RichFaces package in standalone versions of Red Hat JBoss BRMS 5.3.1.

Security Fix(es):

• RichFaces: Expression Language injection via UserResource allows for unauthenticated remote code execution (CVE-2018-14667)

See https://access.redhat.com/solutions/3660371 for specific information regarding this flaw.

For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.

Red Hat would like to thank Joao Filho Matos Figueiredo for reporting this issue.