JBoss Enterprise Application Platform 6.4 Update 19 Release Notes
Important: This update is not the latest cumulative patch, it is recommended to apply the latest update, see these links for the latest:
In order to better meet customer expectations, micro releases for JBoss EAP 6 have been discontinued and replaced with updates delivered on a repeating schedule, targeting a new release every 6 weeks.
Each new update will contain a number of bug fixes for customer reported issues and potentially a number of security fixes. We expect that the updates will substantially reduce the number of individual patches that we produce and that customers must manage to keep their installations up to date.
For more information see the following Red Hat Knowledgebase articles: Maintenance Release Changes in EAP 6.2+ and Updated Patch Management with EAP 6.2+
This update includes all fixes and changes from This content is not included.JBoss EAP 6.4 Update 18
This update includes fixes for the following security related issues:
| ID | Component | Summary |
|---|---|---|
| CVE-2018-1041 | jbossas | jboss-remoting: High CPU Denial of Service |
| CVE-2017-12617 | jbossas | jbossweb: tomcat: Remote Code Execution bypass for CVE-2017-12615 |
| CVE-2017-12174 | jbossas | hornetq: artemis/hornetq: memory exhaustion via UDP and JGroups discovery |
| CVE-2017-2582 | Security | The fix for CVE-2017-2582 breaks the feature of attribute replacement with system property in picketlink.xml |
This update includes the following bug fixes or changes:
| ID | Component | Summary |
|---|---|---|
| This content is not included.1373412 | Clustering | TimeoutException when request ends up on non-coordinator node (invalidation cache, web session passivation and shared cache store) |
| This content is not included.1360391 | EJB | EJB client unnecessary mark a channel/connection as broken if can't read a message [details] |
| This content is not included.1508105 | EJB | Default SFSB Lifecycle methods transaction attribute causing warnings [details] |
| This content is not included.1500297 | EJB | Address DeploymentUnitProcessor leaks in the codebase [details] |
| This content is not included.1460347 | EJB | EJB run-as identity gets lost if an unsecured ejb in the call stack |
| This content is not included.1469369 | HornetQ | Messages get stuck if you change the configuration to host messages in memory from paging |
| This content is not included.1480095 | JCA | Potential for deadlock on pool's flush This content is not included.[details] |
| This content is not included.1497591 | JCA | set-tx-query-timeout does not work when the remaining transaction timeout is shorter than one second [details] |
| This content is not included.1531005 | JCA | Pool.flush does not work correctly |
| This content is not included.1518851 | JMS | Add CriticalAnalyzer to TimedBuffer operations follow up to BZ1487313 |
| This content is not included.1516650 | JMS | Failback not working on NFSv4 [details] |
| This content is not included.1429570 | PicketLink | SAML2STSLoginModule cannot be configured with module options instead of configFile |
| This content is not included.1464597 | Web | losing security context with parallel requests to secured REST EJB This content is not included.[details] |
| This content is not included.1523870 | Web | Clustered session still unexpectedly expired by sso after cluster member is stopped |
| This content is not included.1403939 | Web Services | @javax.jws.Oneway causes security-context to be lost This content is not included.[details] |
Note: This update should only be applied to installer or zip-based installations.
To apply this update using the CLI on Unix-based systems, run the following command from JBOSS_HOME:
bin/jboss-cli.sh "patch apply path/to/jboss-eap-6.4.19-patch.zip"
To apply this update using the CLI on Windows-based systems, run the following command from JBOSS_HOME:
bin\jboss-cli.bat "patch apply path\to\jboss-eap-6.4.19-patch.zip"
These commands will apply the update to the installation that contains the CLI script. Other scenarios and use of the management console are covered in the This content is not included.JBoss EAP 6.4 Installation Guide