—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Moderate: xmlrpc security update
Advisory ID: RHSA-2018:2317-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2018:2317
Issue date: 2018-07-31
CVE Names: CVE-2016-5003
=====================================================================
1. Summary:
An update for xmlrpc is now available for Red Hat Virtualization 4 for Red
Hat Enterprise Linux 7.
Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Tools for RHV Engine – noarch
3. Description:
XML-RPC is a way to make remote procedure calls over the Internet. It
converts procedure calls into XML documents, sends them to a remote server
using the HTTP protocol, and gets back the response as XML.
The following packages have been upgraded to a later upstream version:
xmlrpc (3.1.3). (BZ#1594618)
Security Fix(es):
* xmlrpc: Deserialization of untrusted Java object through
<ex:serializable> tag (CVE-2016-5003)
For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1508123 – CVE-2016-5003 xmlrpc: Deserialization of untrusted Java object through <ex:serializable> tag
6. Package List:
Tools for RHV Engine:
Source:
xmlrpc-3.1.3-9.el7_5.src.rpm
noarch:
xmlrpc-client-3.1.3-9.el7_5.noarch.rpm
xmlrpc-common-3.1.3-9.el7_5.noarch.rpm
xmlrpc-javadoc-3.1.3-9.el7_5.noarch.rpm
xmlrpc-server-3.1.3-9.el7_5.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2016-5003
https://access.redhat.com/security/updates/classification/#moderate
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2018 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1
iQIVAwUBW2CiAtzjgjWX9erEAQhJUBAApzj4SRzqd9j+Rfhm9IwOoG1X5/60nxOk
t7yt09g+IbmJHNSwCToqDaz8prWWv60vvnl9paoW2LGfb76etoDWpJE02YaLuqUX
LQRj5Lm67fU5bsFdRJWzjih5WqskXgME5kGqkzMH8htlIdcsCs3KN915hrEOorcg
6saWzmuV4FKHsHx7U5eHR6YTmYGCzZ1z2glWQu3pjCRPlvPl8rriyfcEVJkU7utw
fv4GI8O3TBlFqYnTSYa54Tg23h0v5lsBfS1y4rZGUnvWKX54A60QQZbaHBrOaQWB
NFqx9UbY+M8s//8XmUaqZs0WIxh/6hxQ843+US5hXtYnU2K1HfUCBBro+6w0lrmp
ivr1lv328/SssWWIu8VNjihfgTH9a2I59WEsBW5FfUfsuSctpAy/mxbeRnyenOCL
btnRNB9v7CVzKSy0sVjutN+DsoxgENgqxZ6RKQoUs9g0LB6hbIwcOsEwlfCke6mU
S/GKPUQqxk6jpoTEHIMRKafOnuu5cLZ4okYA++x3eNLVEjChnPc/2JUoY95IN3cl
XH+/INet4p6nD/7POv2J9l6EGPvGfM/b9OgUVdNdpj0Mg7hD/QkY07QMSwHk0g8F
ebdZHqddHRjCfxUzCQ1l0SpLCHQXd/gdPFNAxfo6ntVsGPFHYfaIimqB4DtmdcXh
J4NQ/YfCNLg=
=uh89
—–END PGP SIGNATURE—–
—
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
