RichFaces versions 3.x through 3.3.4 is vulnerable to injection of arbitrary EL expressions in org.richfaces.renderkit.html.Paint2DResource allowing remote attackers to execute arbitrary code. External Reference: https://codewhitesec.blogspot.com/2018/05/poor-richfaces.html
Upstream issue: https://issues.jboss.org/browse/RF-14310
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform Via RHSA-2018:2663 https://access.redhat.com/errata/RHSA-2018:2663
This issue has been addressed in the following products: Red Hat JBoss Enterprise Application Platform 5 for RHEL 5 Red Hat JBoss Enterprise Application Platform 5 for RHEL 6 Via RHSA-2018:2664 https://access.redhat.com/errata/RHSA-2018:2664
This issue has been addressed in the following products: Red Hat JBoss Operations Network Via RHSA-2018:2930 https://access.redhat.com/errata/RHSA-2018:2930