-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Application Platform 7.2.7 on RHEL 7 security update Advisory ID: RHSA-2020:0805-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2020:0805 Issue date: 2020-03-12 CVE Names: CVE-2019-0205 CVE-2019-0210 CVE-2019-10086 CVE-2019-12400 CVE-2019-14887 CVE-2019-20444 CVE-2019-20445 CVE-2020-7238 ===================================================================== 1. Summary: An update is now available for Red Hat JBoss Enterprise Application Platform 7.2 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat JBoss EAP 7.2 for RHEL 7 Server - noarch, x86_64 3. Description: This release of Red Hat JBoss Enterprise Application Platform 7.2.7 serves as a replacement for Red Hat JBoss Enterprise Application Platform 7.2.6, and includes bug fixes and enhancements. See the Red Hat JBoss Enterprise Application Platform 7.2.7 Release Notes for information about the most significant bug fixes and enhancements included in this release. Security Fix(es): * commons-beanutils: apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086) * libthrift: thrift: Endless loop when feed with specific input data (CVE-2019-0205) * libthrift: thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol (CVE-2019-0210) * xmlsec: xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source (CVE-2019-12400) * wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use (CVE-2019-14887) * netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238) * netty: HTTP request smuggling (CVE-2019-20444) * netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header (CVE-2019-20445) For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section. 4. Solution: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1764607 - CVE-2019-0210 thrift: Out-of-bounds read related to TJSONProtocol or TSimpleJSONProtocol 1764612 - CVE-2019-0205 thrift: Endless loop when feed with specific input data 1764658 - CVE-2019-12400 xml-security: Apache Santuario potentially loads XML parsing code from an untrusted source 1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default 1772008 - CVE-2019-14887 wildfly: The 'enabled-protocols' value in legacy security is not respected if OpenSSL security provider is in use 1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling 1798509 - CVE-2019-20445 netty: HttpObjectDecoder.java allows Content-Length header to accompanied by second Content-Length header 1798524 - CVE-2019-20444 netty: HTTP request smuggling 6. JIRA issues fixed (https://issues.jboss.org/): JBEAP-16051 - [GSS](7.2.z) Upgrade javax.el-impl from 3.0.1.b08-redhat-1 to 3.0.1.b08-redhat-00003 JBEAP-17386 - [GSS](7.2.z) Upgrade Artemis from 2.9.0.redhat-00005 to 2.9.0.redhat-00009 JBEAP-17683 - [GSS](7.2.z) Upgrade JBoss Remoting from 5.0.16.Final-redhat-00001 to 5.0.17.Final-redhat-00001 JBEAP-17963 - [GSS](7.2.z) Upgrade Hibernate ORM from 5.3.14.Final-redhat-00001 to 5.3.15.Final-redhat-00001 JBEAP-18008 - [GSS](7.2.z) Upgrade Woodstox from 5.0.3.redhat-1 to 6.0.3.redhat-00001 JBEAP-18151 - Tracker bug for the EAP 7.2.7 release for RHEL-7 JBEAP-18160 - [GSS](7.2.z) Upgrade wildfly-http-client from 1.0.18.Final-redhat-00001 to 1.0.20.Final-redhat-00001 JBEAP-18164 - [GSS](7.2.z) Upgrade HAL from 3.0.19.Final to 3.0.20.Final JBEAP-18220 - (7.2.z) Upgrade PicketLink bindings from 2.5.5.SP12-redhat-00010 to 2.5.5.SP12-redhat-00011 JBEAP-18274 - (7.2.z) Upgrade IronJacamar from 1.4.18.Final to 1.4.20.Final JBEAP-18284 - [GSS](7.2.z) Upgrade WildFly Core from 6.0.21 to 6.0.23 JBEAP-18292 - (7.2.z) Upgrade JAXB from 2.3.1 to 2.3.3-b02 and com.sun.istack from 3.0.7 to 3.0.10 JBEAP-18318 - [GSS](7.2.z) Upgrade jboss-ejb-client from 4.0.27.Final to 4.0.28.Final JBEAP-18327 - [GSS](7.2.z) Upgrade JSF based on Mojarra 2.3.5.SP3-redhat-00004 to 2.3.5.SP3-redhat-00005 JBEAP-18404 - [GSS](7.2.z) Upgrade Infinispan from 9.3.7.Final-redhat-00001 to 9.3.8.Final-redhat-00001 JBEAP-18437 - (7.2.z) Upgrade wildfly-transaction-client from 1.1.8.Final-redhat-00001 to 1.1.9.Final-redhat-00001 JBEAP-18504 - [GSS](7.2.z) Upgrade PicketLink bindings from 2.5.5.SP12-redhat-00011 to 2.5.5.SP12-redhat-00012 JBEAP-18699 - [GSS](7.2.z) Upgrade WildFly Core from 6.0.23 to 6.0.24 7. Package List: Red Hat JBoss EAP 7.2 for RHEL 7 Server: Source: eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el7eap.src.rpm eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.el7eap.src.rpm eap7-glassfish-el-3.0.1-4.b08_redhat_00003.1.el7eap.src.rpm eap7-glassfish-jaxb-2.3.3-4.b02_redhat_00001.1.el7eap.src.rpm eap7-glassfish-jsf-2.3.5-7.SP3_redhat_00005.1.el7eap.src.rpm eap7-hal-console-3.0.20-1.Final_redhat_00001.1.el7eap.src.rpm eap7-hibernate-5.3.15-1.Final_redhat_00001.1.el7eap.src.rpm eap7-infinispan-9.3.8-1.Final_redhat_00001.1.el7eap.src.rpm eap7-ironjacamar-1.4.20-1.Final_redhat_00001.1.el7eap.src.rpm eap7-jackson-databind-2.9.10.2-1.redhat_00001.1.el7eap.src.rpm eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.src.rpm eap7-jboss-ejb-client-4.0.28-1.Final_redhat_00001.1.el7eap.src.rpm eap7-jboss-remoting-5.0.17-1.Final_redhat_00001.1.el7eap.src.rpm eap7-jboss-server-migration-1.3.1-8.Final_redhat_00009.1.el7eap.src.rpm eap7-picketlink-bindings-2.5.5-23.SP12_redhat_00012.1.el7eap.src.rpm eap7-stax2-api-4.2.0-1.redhat_00001.1.el7eap.src.rpm eap7-sun-istack-commons-3.0.10-1.redhat_00001.1.el7eap.src.rpm eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.src.rpm eap7-wildfly-7.2.7-4.GA_redhat_00004.1.el7eap.src.rpm eap7-wildfly-http-client-1.0.20-1.Final_redhat_00001.1.el7eap.src.rpm eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.src.rpm eap7-wildfly-transaction-client-1.1.9-1.Final_redhat_00001.1.el7eap.src.rpm eap7-woodstox-core-6.0.3-1.redhat_00001.1.el7eap.src.rpm eap7-xml-security-2.1.4-1.redhat_00001.1.el7eap.src.rpm noarch: eap7-activemq-artemis-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-cli-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-commons-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-core-client-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-dto-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-hornetq-protocol-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-hqclient-protocol-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-jdbc-store-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-jms-client-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-jms-server-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-journal-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-ra-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-selector-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-server-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-service-extensions-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-activemq-artemis-tools-2.9.0-2.redhat_00009.1.el7eap.noarch.rpm eap7-apache-commons-beanutils-1.9.4-1.redhat_00002.1.el7eap.noarch.rpm eap7-codemodel-2.3.3-4.b02_redhat_00001.1.el7eap.noarch.rpm eap7-glassfish-el-3.0.1-4.b08_redhat_00003.1.el7eap.noarch.rpm eap7-glassfish-el-impl-3.0.1-4.b08_redhat_00003.1.el7eap.noarch.rpm eap7-glassfish-jaxb-2.3.3-4.b02_redhat_00001.1.el7eap.noarch.rpm eap7-glassfish-jsf-2.3.5-7.SP3_redhat_00005.1.el7eap.noarch.rpm eap7-hal-console-3.0.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-hibernate-5.3.15-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-hibernate-core-5.3.15-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-hibernate-entitymanager-5.3.15-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-hibernate-envers-5.3.15-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-hibernate-java8-5.3.15-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-infinispan-9.3.8-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-infinispan-cachestore-jdbc-9.3.8-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-infinispan-cachestore-remote-9.3.8-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-infinispan-client-hotrod-9.3.8-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-infinispan-commons-9.3.8-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-infinispan-core-9.3.8-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-infinispan-hibernate-cache-commons-9.3.8-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-infinispan-hibernate-cache-spi-9.3.8-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-infinispan-hibernate-cache-v53-9.3.8-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-ironjacamar-1.4.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-ironjacamar-common-api-1.4.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-ironjacamar-common-impl-1.4.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-ironjacamar-common-spi-1.4.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-ironjacamar-core-api-1.4.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-ironjacamar-core-impl-1.4.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-ironjacamar-deployers-common-1.4.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-ironjacamar-jdbc-1.4.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-ironjacamar-validator-1.4.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-istack-commons-runtime-3.0.10-1.redhat_00001.1.el7eap.noarch.rpm eap7-istack-commons-tools-3.0.10-1.redhat_00001.1.el7eap.noarch.rpm eap7-jackson-databind-2.9.10.2-1.redhat_00001.1.el7eap.noarch.rpm eap7-jaegertracing-jaeger-client-java-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm eap7-jaegertracing-jaeger-client-java-core-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm eap7-jaegertracing-jaeger-client-java-thrift-0.34.1-1.redhat_00002.1.el7eap.noarch.rpm eap7-jaxb-jxc-2.3.3-4.b02_redhat_00001.1.el7eap.noarch.rpm eap7-jaxb-runtime-2.3.3-4.b02_redhat_00001.1.el7eap.noarch.rpm eap7-jaxb-xjc-2.3.3-4.b02_redhat_00001.1.el7eap.noarch.rpm eap7-jboss-ejb-client-4.0.28-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-jboss-remoting-5.0.17-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-jboss-server-migration-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-cli-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-core-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-eap6.4-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-eap6.4-to-eap7.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-eap7.0-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-eap7.0-to-eap7.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-eap7.1-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-eap7.1-to-eap7.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-eap7.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly10.0-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly10.0-to-eap7.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly10.1-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly10.1-to-eap7.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly11.0-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly11.0-to-eap7.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly12.0-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly12.0-to-eap7.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly13.0-server-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly14.0-server-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly8.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly8.2-to-eap7.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly9.0-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-jboss-server-migration-wildfly9.0-to-eap7.2-1.3.1-8.Final_redhat_00009.1.el7eap.noarch.rpm eap7-picketlink-bindings-2.5.5-23.SP12_redhat_00012.1.el7eap.noarch.rpm eap7-picketlink-wildfly8-2.5.5-23.SP12_redhat_00012.1.el7eap.noarch.rpm eap7-relaxng-datatype-2.3.3-4.b02_redhat_00001.1.el7eap.noarch.rpm eap7-rngom-2.3.3-4.b02_redhat_00001.1.el7eap.noarch.rpm eap7-stax2-api-4.2.0-1.redhat_00001.1.el7eap.noarch.rpm eap7-sun-istack-commons-3.0.10-1.redhat_00001.1.el7eap.noarch.rpm eap7-thrift-0.13.0-1.redhat_00002.1.el7eap.noarch.rpm eap7-txw2-2.3.3-4.b02_redhat_00001.1.el7eap.noarch.rpm eap7-wildfly-7.2.7-4.GA_redhat_00004.1.el7eap.noarch.rpm eap7-wildfly-http-client-common-1.0.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-wildfly-http-ejb-client-1.0.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-wildfly-http-naming-client-1.0.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-wildfly-http-transaction-client-1.0.20-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-wildfly-java-jdk11-7.2.7-4.GA_redhat_00004.1.el7eap.noarch.rpm eap7-wildfly-java-jdk8-7.2.7-4.GA_redhat_00004.1.el7eap.noarch.rpm eap7-wildfly-javadocs-7.2.7-4.GA_redhat_00004.1.el7eap.noarch.rpm eap7-wildfly-modules-7.2.7-4.GA_redhat_00004.1.el7eap.noarch.rpm eap7-wildfly-openssl-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm eap7-wildfly-openssl-java-1.0.9-2.SP03_redhat_00001.1.el7eap.noarch.rpm eap7-wildfly-transaction-client-1.1.9-1.Final_redhat_00001.1.el7eap.noarch.rpm eap7-woodstox-core-6.0.3-1.redhat_00001.1.el7eap.noarch.rpm eap7-xml-security-2.1.4-1.redhat_00001.1.el7eap.noarch.rpm eap7-xsom-2.3.3-4.b02_redhat_00001.1.el7eap.noarch.rpm x86_64: eap7-wildfly-openssl-linux-x86_64-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm eap7-wildfly-openssl-linux-x86_64-debuginfo-1.0.9-2.SP03_redhat_00001.1.el7eap.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 8. References: https://access.redhat.com/security/cve/CVE-2019-0205 https://access.redhat.com/security/cve/CVE-2019-0210 https://access.redhat.com/security/cve/CVE-2019-10086 https://access.redhat.com/security/cve/CVE-2019-12400 https://access.redhat.com/security/cve/CVE-2019-14887 https://access.redhat.com/security/cve/CVE-2019-20444 https://access.redhat.com/security/cve/CVE-2019-20445 https://access.redhat.com/security/cve/CVE-2020-7238 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/ https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.2/html-single/installation_guide/ 9. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXmpsd9zjgjWX9erEAQiQSg//TglqDCNJpUNOr36DEOGhxNMcBgRZFRho U1Tb+Xf0KSLyg9IDdAdSrIFFuVLYseVSvxDiwwHnaX6+zdyJIgqdEaDrHLp7ABnQ ZMG5HzTpmYBbSNVcHCFCTvjwg9AMAi13WpBY+aqolLS42JHKSQLKLUb70tdE/c71 S9kpI2nPg2XrrssxE78SUZVaa0SLWvb73qMQgHpfAf1hw8XErZUYXhUgSIZTghBN HEV4tFwOT90bVP6Ujs20fuPhXmiMP/ERo4yM92oEb2y6zf1GlJ4Vvz8MyGTiIgmo 0/HrTSJWoo8YtXfVJZwEZdNYnt/IimLqQhalAXKBr3R4hZ4PSyb17wStMHC/AO6k VkFRB9NYQ7a/NFwVI2h1tdkgZsq7TjZQIgLcv6IXOFFVddsUUzZl4JcGSSMQ+SN8 PjdegJmQlkL4ajqwndCOSX3GvAHOoqy9s0KS/LcXeiwx/zfYBST5yn+qY3I2BnwN rQdadudfAWP5xxAGOBYGXr5uudGgPNdG5FyweAhiZa8LyqoJWfonFtk494yy1Z7Z RWBVCoUYVkUfGVVXNu4YYk1++o2FGPUxQ6OBKIbZQWRr6hsFf86EDUuHM9SI/b46 F9vLB02Zp0gz31VDAp3Eg1Tu0Y6VpQUETTQ573Vh+VhPXQqv8kJ8gi5tpyVguTwT ZP6uG/uszOI= =EVx1 -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce