-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat JBoss Enterprise Application Platform 7.2.7 security update
Advisory ID:       RHSA-2020:0811-01
Product:           Red Hat JBoss Enterprise Application Platform
Advisory URL:      https://access.redhat.com/errata/RHSA-2020:0811
Issue date:        2020-03-12
CVE Names:         CVE-2019-0205 CVE-2019-0210 CVE-2019-10086 
                   CVE-2019-12400 CVE-2019-14887 CVE-2019-20444 
                   CVE-2019-20445 CVE-2020-7238 
=====================================================================

1. Summary:

An update is now available for Red Hat JBoss Enterprise Application
Platform 7.2.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Description:

This release of Red Hat JBoss Enterprise Application Platform 7.2.7 serves
as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.6,
and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise
Application Platform 7.2.7 Release Notes for information about the most
significant bug fixes and enhancements included in this release.

Security Fix(es):

* commons-beanutils: apache-commons-beanutils: does not suppresses the
class property in PropertyUtilsBean by default (CVE-2019-10086)

* libthrift: thrift: Endless loop when feed with specific input data
(CVE-2019-0205)

* libthrift: thrift: Out-of-bounds read related to TJSONProtocol or
TSimpleJSONProtocol (CVE-2019-0210)

* xmlsec: xml-security: Apache Santuario potentially loads XML parsing code
from an untrusted source (CVE-2019-12400)

* wildfly: The 'enabled-protocols' value in legacy security is not
respected if OpenSSL security provider is in use (CVE-2019-14887)

* netty: HTTP Request Smuggling due to Transfer-Encoding whitespace
mishandling (CVE-2020-7238)

* netty: HTTP request smuggling (CVE-2019-20444)

* netty: HttpObjectDecoder.java allows Content-Length header to accompanied
by second Content-Length header (CVE-2019-20445)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, see the CVE page(s) listed in the
References section.

3. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

The References section of this erratum contains a download link (you must
log in to download the update).

The JBoss server process must be restarted for the update to take effect.

4. Bugs fixed (https://bugzilla.redhat.com/):

1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol
1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data
1764658 - CVE-2019-12400 xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source
1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default
1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling
1798509 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header
1798524 - CVE-2019-20444 netty: HTTP request smuggling

5. JIRA issues fixed (https://issues.jboss.org/):

JBEAP-16051 - [GSS](7.2.z) Upgrade javax.el-impl from 3.0.1.b08-redhat-1 to 3.0.1.b08-redhat-00003
JBEAP-17386 - [GSS](7.2.z) Upgrade Artemis from 2.9.0.redhat-00005 to 2.9.0.redhat-00009
JBEAP-17683 - [GSS](7.2.z) Upgrade JBoss Remoting from 5.0.16.Final-redhat-00001 to 5.0.17.Final-redhat-00001
JBEAP-17963 - [GSS](7.2.z) Upgrade Hibernate ORM from 5.3.14.Final-redhat-00001 to 5.3.15.Final-redhat-00001
JBEAP-18008 - [GSS](7.2.z) Upgrade Woodstox from 5.0.3.redhat-1 to 6.0.3.redhat-00001
JBEAP-18160 - [GSS](7.2.z) Upgrade wildfly-http-client from 1.0.18.Final-redhat-00001 to 1.0.20.Final-redhat-00001
JBEAP-18164 - [GSS](7.2.z) Upgrade HAL from 3.0.19.Final to 3.0.20.Final
JBEAP-18220 - (7.2.z) Upgrade PicketLink bindings from 2.5.5.SP12-redhat-00010 to 2.5.5.SP12-redhat-00011
JBEAP-18274 - (7.2.z) Upgrade IronJacamar from 1.4.18.Final to 1.4.20.Final
JBEAP-18284 - [GSS](7.2.z) Upgrade WildFly Core from 6.0.21 to 6.0.23
JBEAP-18292 - (7.2.z) Upgrade JAXB from 2.3.1 to 2.3.3-b02 and com.sun.istack from 3.0.7 to 3.0.10
JBEAP-18318 - [GSS](7.2.z) Upgrade jboss-ejb-client from 4.0.27.Final to 4.0.28.Final
JBEAP-18327 - [GSS](7.2.z) Upgrade JSF based on Mojarra 2.3.5.SP3-redhat-00004 to 2.3.5.SP3-redhat-00005
JBEAP-18404 - [GSS](7.2.z) Upgrade Infinispan from 9.3.7.Final-redhat-00001 to 9.3.8.Final-redhat-00001
JBEAP-18437 - (7.2.z) Upgrade wildfly-transaction-client from 1.1.8.Final-redhat-00001 to 1.1.9.Final-redhat-00001
JBEAP-18504 - [GSS](7.2.z) Upgrade PicketLink bindings from 2.5.5.SP12-redhat-00011 to 2.5.5.SP12-redhat-00012
JBEAP-18699 - [GSS](7.2.z) Upgrade WildFly Core from 6.0.23 to 6.0.24

6. References:

https://access.redhat.com/security/cve/CVE-2019-0205
https://access.redhat.com/security/cve/CVE-2019-0210
https://access.redhat.com/security/cve/CVE-2019-10086
https://access.redhat.com/security/cve/CVE-2019-12400
https://access.redhat.com/security/cve/CVE-2019-14887
https://access.redhat.com/security/cve/CVE-2019-20444
https://access.redhat.com/security/cve/CVE-2019-20445
https://access.redhat.com/security/cve/CVE-2020-7238
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.2
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/installation_guide/

7. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXmpq0tzjgjWX9erEAQgD1A//fPta8PQ2Tffo1GA2OwV1HLeYE1Zeu1yl
lOQA1r3bp7lBwZcATNkD1KmMCN+9MVf14MzRg/4LBbECZokif4mNnAoaHWdJFkvO
/ScZCF96l3PJN0TYjpZ6RYPQYxn9wnao2/x1/JgsXw9kNBXhu5lwtZpx7xSNO2v8
5WSOg6jJ7380OGevarqarZ7Im37QHz3bdgtPcoTI0oxaNDFm5gTk4OCu5i7iqPWc
ZG/hIQj7p8mGdARSaR4RWiimkaH1jn68eb1dhL7JqFmZOFUhr/y/pKMGAd0f7uzP
OhOxmTzrMKNfmJcOHpmH+y6P23CbffEr69K+MiwDguqUL/NY1kEdOxEr0MeZeC0P
zYQM8RtKMQamcZiqnru9XBJ4+jCIJumw6zql+VbXj81wiy3D2qz66mlsAksRtUtu
gdOuDiBQkUpBLWZPQaPCR5EQpo7Yj9REb9fQOoRG4Qw6A+Qv7NpdtMggvNfnBUOr
G+V0wGiynxIUt7tMcTPAQdC0H6d/ZGIjBsTqkga0ruMLpOc5Msn/qyHSWf0QKiq3
+J9s/3/tt6VjRZr5mgDqhkCOdIJNtAjHZf/miznk8bYAl5htWJz/dJHDm8X2okJ+
xOepWX7u/8Y8crwlzlfNJoLWtaLlzDrUpM1ajb7OUA9TVwhpcwjwTTgupxYktfos
8z/GptbnP6M=
=BbNd
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce