-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat JBoss Enterprise Application Platform 7.3 security update Advisory ID: RHSA-2020:3143-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2020:3143 Issue date: 2020-07-23 CVE Names: CVE-2020-10740 CVE-2020-14297 CVE-2020-14307 ==================================================================== 1. Summary: An update is now available for Red Hat JBoss Enterprise Application Platform 7.3. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: Red Hat JBoss Enterprise Application Platform 7.3 is a platform for Java applications based on the WildFly application runtime. This asynchronous patch is a security update for Red Hat JBoss Enterprise Application Platform 7.3. Security Fix(es): * wildfly: unsafe deserialization in Wildfly Enterprise Java Beans (CVE-2020-10740) * jboss-ejb-client: wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service (CVE-2020-14307) * jboss-ejb-client: wildfly: Some EJB transaction objects may get accumulated causing Denial of Service (CVE-2020-14297) For more details about the security issue(s), including the impact, a CVSS score, and other related information, see the CVE page(s) listed in the References section. 3. Solution: Before applying this update, back up your existing Red Hat JBoss Enterprise Application Platform installation and deployed applications. The References section of this erratum contains a download link (you must log in to download the update). You must restart the JBoss server process for the update to take effect. 4. Bugs fixed (https://bugzilla.redhat.com/): 1834512 - CVE-2020-10740 wildfly: unsafe deserialization in Wildfly Enterprise Java Beans 1851327 - CVE-2020-14307 wildfly: EJB SessionOpenInvocations may not be removed properly after a response is received causing Denial of Service 1853595 - CVE-2020-14297 wildfly: Some EJB transaction objects may get accumulated causing Denial of Service 5. References: https://access.redhat.com/security/cve/CVE-2020-10740 https://access.redhat.com/security/cve/CVE-2020-14297 https://access.redhat.com/security/cve/CVE-2020-14307 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=appplatform&downloadType=securityPatches&version=7.3 https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/ https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/html-single/installation_guide/ 6. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBXxnxk9zjgjWX9erEAQjwdA/9HQ60YtRQcdBDHCwZ4BMHZ8qxHKnWCrTC 1rapv9YHxhZbrSCmp3UuvylRVRDsHbenXWDkK13Rq2isG/fM86Cwx7Aa1a8W64X+ 8Qe8llZ9M8UKFD6Hf4J3o8++pYspkNJOWeIHPS6PMUTz0vMlz5Do+fbkkFRPRtyj Rn78wFjVRrEDOEDWoskn1mBxnOy6jEkWvXliZnJyL7pkfwIa1DvTZiI2JziOnFqo dLTE/vBHT8Ty2X/493i1ERqBZjV+KjzXaco1D2Bb9SCqftXMG0m26ePetvTnZf/E hoo2HMgFGznBMlijNs4mI7bJQX4VxzHZUL+5UooMs+ADSpkB5Zw0nf9akY/yx4xJ 9Hhi5VWeqDnEi2lhmNI9YJp/K4AW9osFkcxLr6zweu/498asC6aPPviG/SrARagW 6mdgR23opjOZc7pJ39ZQmWy9W+6KtyRtJkNXcIiRqF+g2/b1j8F5G0Fmf7EEUq99 YGxL/qsVTaxCQrmrEC2h/qfnsDhSn2i9Z7s0UqiRkWgVJwnBXMdY8CyodgG254f/ kf+maeTHZbLin5GLabpmCfsxwwr8EtV+ERpP4UCUVf9DZbH97XHs3uT4UHwVD/Rb ohnVwj/JQgWKSEgUaZe1O8HpRwQhRaqDo/cQYS9gTSZxOrw0dvDp/yfftga52RuQ wgce3QJQ0tg=Ymhp -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce