CVE-2016-9606 Red Hat Update for eap7-jboss-ec2-eap (RHSA-2017:1412)

The eap7-jboss-ec2-eap packages provide scripts for Red Hat JBoss Enterprise Application Platform running on the Amazon Web Services (AWS) Elastic Compute Cloud (EC2).

It was discovered that under certain conditions RESTEasy could be forced to parse a request with YamlProvider, resulting in unmarshalling of potentially untrusted data. An attacker could possibly use this flaw execute arbitrary code with the permissions of the application using RESTEasy. (CVE-2016-9606)
It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via path traversal. (CVE-2017-2595)
It was discovered that the code that parsed the HTTP request line permitted invalid characters. This could be exploited, in conjunction with a proxy that also permitted the invalid characters but with a different interpretation, to inject data into the HTTP response. By manipulating the HTTP response the attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own. (CVE-2017-2666)
It was found that with non-clean TCP close, Websocket server gets into infinite loop on every IO thread, effectively causing DoS. (CVE-2017-2670)

Affected Products:
JBoss Enterprise Application Platform 7.0 for RHEL 7 x86_64
JBoss Enterprise Application Platform 7.0 for RHEL 6 x86_64
JBoss Enterprise Application Platform 7.0 for RHEL 6 i386

An attacker could possibly use this flaw execute arbitrary code with the permissions of the application using RESTEasy. (CVE-2016-9606)
On successful exploitation it allows arbitrary file read to authenticated user via path traversal. (CVE-2017-2595), Websocket server gets into infinite loop on every IO thread, effectively causing DoS. (CVE-2017-2670)
An attacker could poison a web-cache, perform an XSS attack, or obtain sensitive information from requests other than their own. (CVE-2017-2666)

Upgrade to the latest packages which contain a patch. Refer to Applying Package Updates to RHEL system for details.

Refer to Red Hat security advisory RHSA-2017:1412 to address this issue and obtain more information.

Patch:
Following are links for downloading patches to fix the vulnerabilities:

RHSA-2017:1412: Red Hat Enterprise Linux