-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Application Platform 7.3 security update Advisory ID: RHSA-2020:0962-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2020:0962 Issue date: 2020-03-24 CVE Names: CVE-2019-0205 CVE-2019-0210 CVE-2019-14887 CVE-2020-1745 ==================================================================== 1. Summary: An update is now available for Red Hat JBoss Enterprise Application Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss EAP 7.3 for BaseOS-8 - noarch, x86_64 Red Hat JBoss EAP 7.3 for RHEL 6 Server - noarch, x86_64 Red Hat JBoss EAP 7.3 for RHEL 7 Server - noarch, x86_64 3. Description: Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. Security Fix(es): * The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use (CVE-2019-14887) * libthrift: thrift: Endless loop when feed with specific input data (CVE-2019-0205) * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210) * undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745) For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section. 4. Solution: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. You must restart the JBoss server process for the update to take effect. For details about how to apply this update, see: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol 1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data 1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use 1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability 6. Package List: Red Hat JBoss EAP 7.3 for RHEL 6 Server: Source: eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el6eap.src.rpm eap7-thrift-0.13.0-1.redhat_00002.1.el6eap.src.rpm eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el6eap.src.rpm eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el6eap.src.rpm eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el6eap.src.rpm noarch: eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm eap7-thrift-0.13.0-1.redhat_00002.1.el6eap.noarch.rpm eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el6eap.noarch.rpm eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el6eap.noarch.rpm eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el6eap.noarch.rpm x86_64: eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el6eap.x86_64.rpm eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el6eap.x86_64.rpm Red Hat JBoss EAP 7.3 for RHEL 7 Server: Source: eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.src.rpm eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.src.rpm eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el7eap.src.rpm eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm noarch: eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.noarch.rpm eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el7eap.noarch.rpm eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm x86_64: eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm Red Hat JBoss EAP 7.3 for BaseOS-8: Source: eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap.src.rpm eap7-thrift-0.13.0-1.redhat_00002.1.el8eap.src.rpm eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el8eap.src.rpm eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el8eap.src.rpm eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el8eap.src.rpm noarch: eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm eap7-thrift-0.13.0-1.redhat_00002.1.el8eap.noarch.rpm eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el8eap.noarch.rpm eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el8eap.noarch.rpm eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el8eap.noarch.rpm x86_64: eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el8eap.x86_64.rpm eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el8eap.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2019-0205 https://access.redhat.com/security/cve/CVE-2019-0210 https://access.redhat.com/security/cve/CVE-2019-14887 https://access.redhat.com/security/cve/CVE-2020-1745 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/ https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXnnxl9zjgjWX9erEAQg0Kg//SqSxSEZGGRcaHJePfJ3GtY1E6EcqTJAm SsnW0in2uP/PXicnAV5sCQtaw7GbmsIArm5SSPabYnpvkHVUxgBSmRFzd0Rga3Uh Q3JhI6kdaZkDz/q+o6IRl/SwY046elslZuO6QbNnnnMMBq+Nz8OUky5pGHeadfHY kMF1J3OSdi1gRblsqeSh5j0OC6cyCBD9yjUzmN36cMEqZzdOAcS06hNqEwHtCuQE eFBPSHmelXs4nk2OyMMW77uXHDAiTvVgvhjXXj7tzVa3Mhn731jaITu1gBnx7g9b rqzlB4j5jawpuTjmdaOmmKaN8DnAf938po7vNKB7SYzRDV1EG3Av8/IWKI1ooFVN 1zXrVhoL5Myes8GezS24LzzkX26NNAhgE2VqOu9BaFPEct4wM7IZ8xTNRYkuGpqu 8+IqwK5XDNOcV25q+5XNAYCBTf13B/bAY9nz63DOf1M3Xje44YUOjb4njAupwCWA YX0s37ZcoaSaX6jW9c7qMl0z+hyy+QY/C1uGz2jbAe4FJDukqU07R6QMBglrYgXm hZxEFfM49nhPZ8TCgULssJcHMt1fBQDZmEgfcga17einBTtrTDjofP9XT+1maecU dbAuSkb1J9SIYhyVicwvQGyqW5Hw8fpiChLdFe7It8os+N/viGpETJ6v6NKQ8U4r z0cTVdArboc=SCgd -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce