what you don't know can hurt you

Red Hat Security Advisory 2020-0962-01

Red Hat Security Advisory 2020-0962-01
Posted Mar 24, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-0962-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. A file read / inclusion vulnerability was addressed among other issues.

tags | advisory, java
systems | linux, redhat
advisories | CVE-2019-0205, CVE-2019-0210, CVE-2019-14887, CVE-2020-1745
MD5 | 2364863c72d900337fe78f661f5c81b0

Red Hat Security Advisory 2020-0962-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat JBoss Enterprise Application Platform 7.3 security update
Advisory ID: RHSA-2020:0962-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0962
Issue date: 2020-03-24
CVE Names: CVE-2019-0205 CVE-2019-0210 CVE-2019-14887
CVE-2020-1745
====================================================================
1. Summary:

An update is now available for Red Hat JBoss Enterprise Application
Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat JBoss EAP 7.3 for BaseOS-8 - noarch, x86_64
Red Hat JBoss EAP 7.3 for RHEL 6 Server - noarch, x86_64
Red Hat JBoss EAP 7.3 for RHEL 7 Server - noarch, x86_64

3. Description:

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java
applications based on the WildFly application runtime.

Security Fix(es):

* The 'enabled-protocols' value in legacy security is not respected if
OpenSSL security provider is in use (CVE-2019-14887)

* libthrift: thrift: Endless loop when feed with specific input data
(CVE-2019-0205)

* libthrift: thrift: Out-of-bounds read related to TJSONProtocol or
TSimpleJSONProtocol (CVE-2019-0210)

* undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, see the CVE page(s) listed in the
References section.

4. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

You must restart the JBoss server process for the update to take effect.

For details about how to apply this update, see:
https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol
1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data
1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability

6. Package List:

Red Hat JBoss EAP 7.3 for RHEL 6 Server:

Source:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el6eap.src.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el6eap.src.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el6eap.src.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el6eap.src.rpm
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el6eap.src.rpm

noarch:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el6eap.noarch.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el6eap.noarch.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el6eap.noarch.rpm
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el6eap.noarch.rpm

x86_64:
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el6eap.x86_64.rpm
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el6eap.x86_64.rpm

Red Hat JBoss EAP 7.3 for RHEL 7 Server:

Source:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.src.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.src.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el7eap.src.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm

noarch:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.noarch.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el7eap.noarch.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm

x86_64:
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm

Red Hat JBoss EAP 7.3 for BaseOS-8:

Source:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap.src.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el8eap.src.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el8eap.src.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el8eap.src.rpm
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el8eap.src.rpm

noarch:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el8eap.noarch.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el8eap.noarch.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el8eap.noarch.rpm
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el8eap.noarch.rpm

x86_64:
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el8eap.x86_64.rpm
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el8eap.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-0205
https://access.redhat.com/security/cve/CVE-2019-0210
https://access.redhat.com/security/cve/CVE-2019-14887
https://access.redhat.com/security/cve/CVE-2020-1745
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXnnxl9zjgjWX9erEAQg0Kg//SqSxSEZGGRcaHJePfJ3GtY1E6EcqTJAm
SsnW0in2uP/PXicnAV5sCQtaw7GbmsIArm5SSPabYnpvkHVUxgBSmRFzd0Rga3Uh
Q3JhI6kdaZkDz/q+o6IRl/SwY046elslZuO6QbNnnnMMBq+Nz8OUky5pGHeadfHY
kMF1J3OSdi1gRblsqeSh5j0OC6cyCBD9yjUzmN36cMEqZzdOAcS06hNqEwHtCuQE
eFBPSHmelXs4nk2OyMMW77uXHDAiTvVgvhjXXj7tzVa3Mhn731jaITu1gBnx7g9b
rqzlB4j5jawpuTjmdaOmmKaN8DnAf938po7vNKB7SYzRDV1EG3Av8/IWKI1ooFVN
1zXrVhoL5Myes8GezS24LzzkX26NNAhgE2VqOu9BaFPEct4wM7IZ8xTNRYkuGpqu
8+IqwK5XDNOcV25q+5XNAYCBTf13B/bAY9nz63DOf1M3Xje44YUOjb4njAupwCWA
YX0s37ZcoaSaX6jW9c7qMl0z+hyy+QY/C1uGz2jbAe4FJDukqU07R6QMBglrYgXm
hZxEFfM49nhPZ8TCgULssJcHMt1fBQDZmEgfcga17einBTtrTDjofP9XT+1maecU
dbAuSkb1J9SIYhyVicwvQGyqW5Hw8fpiChLdFe7It8os+N/viGpETJ6v6NKQ8U4r
z0cTVdArboc=SCgd
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce
Login or Register to add favorites

File Archive:

September 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    20 Files
  • 2
    Sep 2nd
    15 Files
  • 3
    Sep 3rd
    15 Files
  • 4
    Sep 4th
    4 Files
  • 5
    Sep 5th
    1 Files
  • 6
    Sep 6th
    1 Files
  • 7
    Sep 7th
    15 Files
  • 8
    Sep 8th
    27 Files
  • 9
    Sep 9th
    7 Files
  • 10
    Sep 10th
    16 Files
  • 11
    Sep 11th
    9 Files
  • 12
    Sep 12th
    0 Files
  • 13
    Sep 13th
    0 Files
  • 14
    Sep 14th
    25 Files
  • 15
    Sep 15th
    15 Files
  • 16
    Sep 16th
    15 Files
  • 17
    Sep 17th
    15 Files
  • 18
    Sep 18th
    12 Files
  • 19
    Sep 19th
    1 Files
  • 20
    Sep 20th
    1 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    21 Files
  • 23
    Sep 23rd
    8 Files
  • 24
    Sep 24th
    15 Files
  • 25
    Sep 25th
    4 Files
  • 26
    Sep 26th
    1 Files
  • 27
    Sep 27th
    1 Files
  • 28
    Sep 28th
    20 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close