what you don't know can hurt you

Red Hat Security Advisory 2020-0962-01

Red Hat Security Advisory 2020-0962-01
Posted Mar 24, 2020
Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2020-0962-01 - Red Hat JBoss Enterprise Application Platform 7 is a platform for Java applications based on the WildFly application runtime. A file read / inclusion vulnerability was addressed among other issues.

tags | advisory, java
systems | linux, redhat
advisories | CVE-2019-0205, CVE-2019-0210, CVE-2019-14887, CVE-2020-1745
MD5 | 2364863c72d900337fe78f661f5c81b0

Red Hat Security Advisory 2020-0962-01

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

====================================================================
Red Hat Security Advisory

Synopsis: Important: Red Hat JBoss Enterprise Application Platform 7.3 security update
Advisory ID: RHSA-2020:0962-01
Product: Red Hat JBoss Enterprise Application Platform
Advisory URL: https://access.redhat.com/errata/RHSA-2020:0962
Issue date: 2020-03-24
CVE Names: CVE-2019-0205 CVE-2019-0210 CVE-2019-14887
CVE-2020-1745
====================================================================
1. Summary:

An update is now available for Red Hat JBoss Enterprise Application
Platform 7.3 for Red Hat Enterprise Linux 6, 7, and 8.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

Red Hat JBoss EAP 7.3 for BaseOS-8 - noarch, x86_64
Red Hat JBoss EAP 7.3 for RHEL 6 Server - noarch, x86_64
Red Hat JBoss EAP 7.3 for RHEL 7 Server - noarch, x86_64

3. Description:

Red Hat JBoss Enterprise Application Platform 7 is a platform for Java
applications based on the WildFly application runtime.

Security Fix(es):

* The 'enabled-protocols' value in legacy security is not respected if
OpenSSL security provider is in use (CVE-2019-14887)

* libthrift: thrift: Endless loop when feed with specific input data
(CVE-2019-0205)

* libthrift: thrift: Out-of-bounds read related to TJSONProtocol or
TSimpleJSONProtocol (CVE-2019-0210)

* undertow: AJP File Read/Inclusion Vulnerability (CVE-2020-1745)

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, see the CVE page(s) listed in the
References section.

4. Solution:

Before applying this update, back up your existing Red Hat JBoss Enterprise
Application Platform installation and deployed applications.

You must restart the JBoss server process for the update to take effect.

For details about how to apply this update, see:
https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol
1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data
1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use
1807305 - CVE-2020-1745 undertow: AJP File Read/Inclusion Vulnerability

6. Package List:

Red Hat JBoss EAP 7.3 for RHEL 6 Server:

Source:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el6eap.src.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el6eap.src.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el6eap.src.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el6eap.src.rpm
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el6eap.src.rpm

noarch:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el6eap.noarch.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el6eap.noarch.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el6eap.noarch.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el6eap.noarch.rpm
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el6eap.noarch.rpm

x86_64:
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el6eap.x86_64.rpm
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el6eap.x86_64.rpm

Red Hat JBoss EAP 7.3 for RHEL 7 Server:

Source:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.src.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.src.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el7eap.src.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm

noarch:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.noarch.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el7eap.noarch.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm

x86_64:
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm

Red Hat JBoss EAP 7.3 for BaseOS-8:

Source:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap.src.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el8eap.src.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el8eap.src.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el8eap.src.rpm
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el8eap.src.rpm

noarch:
eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm
eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el8eap.noarch.rpm
eap7-thrift-0.13.0-1.redhat_00002.1.el8eap.noarch.rpm
eap7-undertow-2.0.28-4.SP1_redhat_00002.1.el8eap.noarch.rpm
eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el8eap.noarch.rpm
eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el8eap.noarch.rpm

x86_64:
eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el8eap.x86_64.rpm
eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el8eap.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2019-0205
https://access.redhat.com/security/cve/CVE-2019-0210
https://access.redhat.com/security/cve/CVE-2019-14887
https://access.redhat.com/security/cve/CVE-2020-1745
https://access.redhat.com/security/updates/classification/#important
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/
https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2020 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXnnxl9zjgjWX9erEAQg0Kg//SqSxSEZGGRcaHJePfJ3GtY1E6EcqTJAm
SsnW0in2uP/PXicnAV5sCQtaw7GbmsIArm5SSPabYnpvkHVUxgBSmRFzd0Rga3Uh
Q3JhI6kdaZkDz/q+o6IRl/SwY046elslZuO6QbNnnnMMBq+Nz8OUky5pGHeadfHY
kMF1J3OSdi1gRblsqeSh5j0OC6cyCBD9yjUzmN36cMEqZzdOAcS06hNqEwHtCuQE
eFBPSHmelXs4nk2OyMMW77uXHDAiTvVgvhjXXj7tzVa3Mhn731jaITu1gBnx7g9b
rqzlB4j5jawpuTjmdaOmmKaN8DnAf938po7vNKB7SYzRDV1EG3Av8/IWKI1ooFVN
1zXrVhoL5Myes8GezS24LzzkX26NNAhgE2VqOu9BaFPEct4wM7IZ8xTNRYkuGpqu
8+IqwK5XDNOcV25q+5XNAYCBTf13B/bAY9nz63DOf1M3Xje44YUOjb4njAupwCWA
YX0s37ZcoaSaX6jW9c7qMl0z+hyy+QY/C1uGz2jbAe4FJDukqU07R6QMBglrYgXm
hZxEFfM49nhPZ8TCgULssJcHMt1fBQDZmEgfcga17einBTtrTDjofP9XT+1maecU
dbAuSkb1J9SIYhyVicwvQGyqW5Hw8fpiChLdFe7It8os+N/viGpETJ6v6NKQ8U4r
z0cTVdArboc=SCgd
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce

Comments

RSS Feed Subscribe to this comment feed

No comments yet, be the first!

Login or Register to post a comment

File Archive:

April 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Apr 1st
    60 Files
  • 2
    Apr 2nd
    20 Files
  • 3
    Apr 3rd
    10 Files
  • 4
    Apr 4th
    0 Files
  • 5
    Apr 5th
    0 Files
  • 6
    Apr 6th
    0 Files
  • 7
    Apr 7th
    0 Files
  • 8
    Apr 8th
    0 Files
  • 9
    Apr 9th
    0 Files
  • 10
    Apr 10th
    0 Files
  • 11
    Apr 11th
    0 Files
  • 12
    Apr 12th
    0 Files
  • 13
    Apr 13th
    0 Files
  • 14
    Apr 14th
    0 Files
  • 15
    Apr 15th
    0 Files
  • 16
    Apr 16th
    0 Files
  • 17
    Apr 17th
    0 Files
  • 18
    Apr 18th
    0 Files
  • 19
    Apr 19th
    0 Files
  • 20
    Apr 20th
    0 Files
  • 21
    Apr 21st
    0 Files
  • 22
    Apr 22nd
    0 Files
  • 23
    Apr 23rd
    0 Files
  • 24
    Apr 24th
    0 Files
  • 25
    Apr 25th
    0 Files
  • 26
    Apr 26th
    0 Files
  • 27
    Apr 27th
    0 Files
  • 28
    Apr 28th
    0 Files
  • 29
    Apr 29th
    0 Files
  • 30
    Apr 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2016 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close