-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: EAP XP 2 security update to CVE fixes in the EAP 7.3.x base Advisory ID: RHSA-2021:3516-01 Product: Red Hat JBoss Enterprise Application Platform Advisory URL: https://access.redhat.com/errata/RHSA-2021:3516 Issue date: 2021-09-13 CVE Names: CVE-2021-3597 CVE-2021-3644 CVE-2021-3690 CVE-2021-28170 CVE-2021-29425 ===================================================================== 1. Summary: This advisory resolves CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base. There are no changes to the EAP XP2 code base. NOTE: This advisory is informational only. There are no code changes associated with it. No action is required. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Description: These are CVE issues filed against XP2 releases that have been fixed in the underlying EAP 7.3.x base, so no changes to the EAP XP2 code base. Security Fix(es): * undertow: buffer leak on incoming websocket PONG message may lead to DoS (CVE-2021-3690) * undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS (CVE-2021-3597) * jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate (CVE-2021-28170) * apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 (CVE-2021-29425) * wildfly-core: Invalid Sensitivity Classification of Vault Expression (CVE-2021-3644) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. 3. Solution: This advisory is informational only. There are no code changes associated with it. No action is required. 4. Bugs fixed (https://bugzilla.redhat.com/): 1948752 - CVE-2021-29425 apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 1965497 - CVE-2021-28170 jakarta-el: ELParserTokenManager enables invalid EL expressions to be evaluate 1970930 - CVE-2021-3597 undertow: HTTP2SourceChannel fails to write final frame under some circumstances may lead to DoS 1976052 - CVE-2021-3644 wildfly-core: Invalid Sensitivity Classification of Vault Expression 1991299 - CVE-2021-3690 undertow: buffer leak on incoming websocket PONG message may lead to DoS 5. JIRA issues fixed (https://issues.jboss.org/): JBEAP-22409 - XP 2.0.0 respin (2.0.0-7.3.9.GA) 6. References: https://access.redhat.com/security/cve/CVE-2021-3597 https://access.redhat.com/security/cve/CVE-2021-3644 https://access.redhat.com/security/cve/CVE-2021-3690 https://access.redhat.com/security/cve/CVE-2021-28170 https://access.redhat.com/security/cve/CVE-2021-29425 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_jboss_enterprise_application_platform/7.3/ https://access.redhat.com/articles/6179301 7. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2021 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYT+LxtzjgjWX9erEAQgJfg/9HRNQNHY1dXoE8R2QrMYVC8GaRXuWi36N ynNMNzlxOHpv+lo+PFuAYmEyQenco0GFQ2YNVxlC+OmwxHc5v/ELik32ARHZtES/ OQwlA3tl7xJA4hSvUew6mYA36CujVqkSH5i/EztD5CJrqGXjNAB5476AKSnM4iL9 UA6En/eJMjJceTGgsdC/duJUVt/Vw/VIpJdsoEO61GqkUxKCEQhYafKxku4sDcDW lbxqR4gDyprc0Bn01pevT4iEz4BLKnwA9Gzx+912JLlvlTfrvAanYdu91Ai5i4O4 pTncCjlktDboKZW6mGZ+11w4/HFpiRQA1RWyX1W+CKNMr1JiySQAds+WOJg2qR78 PUIAWd7rCqG2JXmRAni0K1H6cq+NEcW02y89yHyGvEMmPkSqMGdfwlNpZv73hU+D m8fE8L5z+9YRGtPfwGREuLYwB3ZjEjh5NOKnqU32i/7UWDkh4zNs2uTW74MY7bfS 54PakKXz6xErRuA2GTGC0M5Z88/TqWMA0C8VSDHmv7vsMq7k5rgLihmEk1QTB6TM QheN8fNJ9LQ5hCQBKyfnnrmxyB0u6Y8jjWrDWFJY02rtQII6JBke3ZxWY32as6C6 nTROV8laTEp0+PqNOt8AEZUTGgjXmUJGfFgbPhrE897xF88j9GtBIHRlLemlTLNs a7P6Rb1hA6E= =FOXn -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce